Password Generator
Generate strong random passwords online with private browser-only cryptography.
Create a private random password
Generate Strong Passwords Without Sharing Them
Creating a strong, unpredictable password for every online account is the single highest-impact defense against credential stuffing, brute-force cracking, and automated account takeovers. Choose a length of at least 16 to 20 characters and enable all character sets accepted by your service. Every password is created locally in your browser tab and can be cleared from memory with a single click.
Always generate a completely unique password for each login and save it directly in an encrypted password manager. Our recommendations follow modern cybersecurity benchmarks from US NIST SP 800-63B & CISA, the Canadian Centre for Cyber Security (CCCS), and European ENISA & UK NCSC identity protection standards. Read our complete guide to creating a strong password and our essential password security tips.
Password Entropy & Offline Crack-Time Reference Table
Information-theoretic password strength is measured in bits of entropy (H = L × log2(N)). Each additional random character from a 94-character ASCII pool multiplies the attacker's search space by 94 (adding ~6.55 bits of entropy). Below is how character length and pool diversity impact offline cracking time against a modern GPU cluster testing 100 billion hashes per second:
| Password Length | Active Character Sets (Pool Size) | Entropy (Bits) | Offline Crack Time (100B/sec) | Security Rating |
|---|---|---|---|---|
| 8 characters | Upper + Lower + Digits (62) | 47.6 bits | ~36 minutes | Weak (Vulnerable) |
| 12 characters | Upper + Lower + Digits + Symbols (94) | 78.6 bits | ~150 million years | Moderate Baseline |
| 16 characters | Upper + Lower + Digits + Symbols (94) | 104.9 bits | ~1.2 × 1013 years | Strong (Recommended) |
| 20 characters | Upper + Lower + Digits + Symbols (94) | 131.1 bits | ~9.6 × 1020 years | Very Strong (Banking & Email) |
| 24+ characters | Upper + Lower + Digits + Symbols (94) | 157.3+ bits | > 1028 years (Cryptographic Grade) | Maximum (Admin & Cloud Root) |
Choosing a Length & Format: 12, 16, 20, or 24-Character & 256-Bit Passwords
Direct Answer: Set the generator slider to 16 characters (104.9 bits) for everyday logins, 20 to 24 characters (131.1–157.3 bits) for banking, email, and WPA3 Wi-Fi routers, or 40 characters (262.2 bits) when generating a 256-bit cryptographic secret or API token.
12-Character vs. 16-Character Password Generator (PCI DSS v4.0 vs. NIST SP 800-63B)
While PCI DSS v4.0 Requirement 8.3.6 mandates a minimum of 12 characters (78.6 bits of entropy across 94 ASCII characters), modern guidance from US NIST SP 800-63B Rev 4, Canadian CCCS, and EU ENISA recommends 15 to 16+ characters. Moving from 12 to 16 random characters multiplies the total keyspace by 944 (over 78 million times harder to brute-force).
20-Character, 24-Character & 256-Bit Cryptographic Password Generator
For high-value targets — including your primary email account, cloud infrastructure root logins (AWS, GCP, Azure), WPA2/WPA3 Wi-Fi pre-shared keys, and database environment variables — generate a 20 to 24-character string (131.1 to 157.3 bits). If an application requires full 128-bit entropy, use at least 20 characters; for 256-bit entropy, set the slider to 40 characters (40 × 6.555 = 262.2 bits).
Password Generator Without Special Characters, Readability & URL-Safe Modes
Some legacy banking portals, command-line environment variables, and database connection strings reject punctuation symbols like quotes or slashes. Uncheck Symbols to switch into an alphanumeric password generator (62-character pool, providing 95.3 bits of entropy at 16 characters), or check Exclude similar characters to strip look-alike glyphs (O, 0, I, l, 1) when typing credentials onto a smart TV, gaming console, or mobile phone.
How Our Browser-Only window.crypto.getRandomValues() Generator Works
This password generator is engineered around a strict zero-knowledge, client-side architecture. Every character is selected inside your local browser environment using the standardized Web Crypto API:
- Hardware-Backed CSPRNG Seeding: Instead of insecure
Math.random()calls, the generator invokeswindow.crypto.getRandomValues(new Uint32Array(...)), pulling high-entropy random bytes directly from your operating system's cryptographic kernel source. - Guaranteed Character-Class Inclusion & Shuffling: When multiple character sets (lowercase, uppercase, digits, symbols) are checked, the algorithm draws at least one random character from each selected set, fills the remaining positions from the combined character pool, and performs a cryptographic shuffle so character classes can appear in any position.
- Readability & Ambiguity Filters: Enabling Exclude similar characters removes visually ambiguous glyphs (such as
O,0,I,l, and1) when you need to read a password off your screen to sign in on a smart TV or secondary device. - Verifiable Zero Network Traffic: Open your browser's Developer Tools (
F12→ Network tab) while clicking Regenerate. You will see zero API calls, zero form submissions, and zero storage writes inlocalStorageor cookies.
Frequently asked questions
Does The Pass Key store generated passwords?
No. Every password is generated locally in your current browser tab using the Web Crypto API and is never logged, stored, or transmitted to any server.
What is the best password length for important accounts?
Use at least 16 to 20 random characters including uppercase, lowercase, numbers, and symbols for email, banking, cloud storage, and work accounts.
What should I do after generating a password?
Copy it directly into your account registration or password-change form and save it in a trusted password manager. Never reuse the same password across multiple sites.