Developer Tools
Strong Password Generator
Create strong random passwords or memorable passphrases, with a live strength meter and crack-time estimate.
Runs locally in your browser — your input is not uploaded.
Strength: Very strong (129 bits of entropy) · Time to crack offline: longer than the age of the universe
What is this tool?
Good passwords are long and random. Pick a length and the character types a site allows, or switch to passphrase mode for several random words that are easier to remember and type. The strength meter shows the entropy in bits and roughly how long an offline attack would take.
Passwords are created with your browser's cryptographically secure random number generator (crypto.getRandomValues) using unbiased sampling, so every character is equally likely. Each chosen character type is guaranteed to appear at least once.
Entropy measures unpredictability: every extra bit doubles the guesses an attacker needs. Aim for at least 60 bits for everyday accounts and 80+ bits for anything important. A 16-character password with letters and numbers has about 95 bits.
Nothing is sent over the network or saved. Close the tab and the passwords are gone.
How to use the Password Generator
- Choose Password for random characters or Passphrase for random words.
- Set the length (or number of words) and the character types: lowercase, uppercase, numbers, and symbols.
- Optionally avoid look-alike characters or limit symbols to the ones a site accepts.
- Check the strength meter, then copy the password. Generate up to 100 at once for bulk accounts.
Examples
Five-word passphrase
Easy to type and still around 60 bits of entropy.
Harbor-Tulip-Velvet7-Comet-Maple
Frequently asked questions
How long should my password be?
At least 14–16 random characters for important accounts. Length matters more than complexity: each extra character multiplies the number of possible passwords.
Are passphrases safe?
Yes, when the words are chosen randomly. Five or six random words give strong protection and are much easier to remember than a jumble of symbols.
Is it safe to generate passwords online?
With ToolForge, generation happens entirely in your browser. Nothing is transmitted, logged, or stored, and you can even disconnect from the internet before generating.
What does the crack time mean?
It estimates how long an offline attacker trying 10 billion guesses per second would need on average. Real attacks against online logins are far slower because of rate limits.
Want more power later?
Premium tools, higher limits, and API access are on the roadmap. V1 stays free and private in your browser.