Free tool · Passwords
Free password generator for strong, random passwords
This free password generator makes strong, random passwords right in your browser. Choose a length and the kinds of characters, then copy the result. The password is never sent anywhere, and nobody, not even Barside, sees it.
The tool starts when the page has loaded. It needs JavaScript.
A strong password is long and random. People are bad at random: we pick words, names, years and patterns that attackers try first. This password generator does the random part for you. It runs in your browser, uses the same random source that encryption uses, and never sends what it makes anywhere.
How to use the password generator
- Choose a Length. Drag the slider or type a number from 8 to 128. The default, 20, is a good choice for most accounts.
- Choose the Characters: capital letters, small letters, numbers and symbols. Every kind you choose appears at least once, because many websites check for that.
- Turn on Leave out look-alikes if you will read the password aloud or type it by hand.
- Press Copy and paste the password where you need it. Press New for another one.
- Need several? Make 5 more gives five extra passwords, each with its own Copy button.
The bar under the password shows its strength in bits, from Weak to Very strong. It updates as you change the settings.
What makes a password strong
A password is strong when it would take too many guesses to find. Attackers who steal a website's password database try billions of guesses a second against it, starting with leaked passwords, dictionary words and common patterns. A random password has no pattern to start with, so the only way in is to try every possibility.
The number of possibilities depends on two things: how many characters the password can use, and how long it is. Length matters most, because each extra character multiplies the total again.
| Length | Small letters only | Letters and numbers | All four kinds |
|---|---|---|---|
| 8 characters | 37.6 bits | 47.6 bits | 51.5 bits |
| 12 characters | 56.4 bits | 71.5 bits | 77.3 bits |
| 16 characters | 75.2 bits | 95.3 bits | 103.1 bits |
| 20 characters | 94.0 bits | 119.1 bits | 128.9 bits |
The table counts the characters this generator uses: 26 small letters, 26 capitals, 10 numbers and 25 symbols. Anything above about 80 bits is out of reach for any attacker today. The tool calls 50 to 69 bits Fair, 70 to 99 Strong, and 100 or more Very strong.
Why random beats clever
Tricks that feel clever do not fool password-cracking software. Swapping letters for look-alike numbers (P@ssw0rd), adding 123 or ! at the end, or using a pet's name with a year are all rules that cracking tools apply automatically. The password strength checker shows how much these tricks really add: usually a bit or two.
A random password has no such weakness. Every character is chosen independently, with equal chances, so knowing part of it tells an attacker nothing about the rest.
How this generator works
- A cryptographic random source. The tool uses your browser's
crypto.getRandomValues, the same source that secure websites rely on, not the ordinary random numbers that games use. - Equal chances for every character. It picks each character with rejection sampling, so no character comes up more often than another.
- At least one of each kind. It first picks one character from each kind you chose, fills the rest from all of them, then shuffles the whole password at random.
- Nothing leaves the page. This page has no analytics, and the tool makes no network requests. You can check: open your browser's network panel while you press New.
Where to keep your passwords
You cannot remember a different 20-character password for every website, and you should not try. A password manager remembers them for you. Barside has one built in: Barside Passwords keeps your logins encrypted on your own computer, fills them into Chrome, Brave and Edge on Windows, copies them on Linux, makes two-step codes and warns you when a password appears in a known data breach. It is free.
If you already pay for a password manager, compare it in our 1Password alternative guide.
Passwords and passphrases
A random password is the strongest choice per character, which matters when a website limits the length. When you have to remember the password or type it often, such as the one that unlocks your computer or your password manager, a passphrase of random words is easier. Six random words from a list of 7,776 give about 77 bits, as strong as a 12-character password of every kind, and far easier to type. Make one with the passphrase generator.
Good habits that go with a strong password
- One password per account. Reused passwords are how one breach turns into many.
- Turn on two-step sign-in wherever a website offers it, so a stolen password alone is not enough.
- Change a password after a breach, not on a schedule. Changing strong passwords often makes people choose weaker ones.
- Never send passwords in chat or email. If you must share one, share it once and change it afterwards.
FAQ
Questions and answers
Is this password generator safe to use?
Yes. The password is made in your browser with its cryptographic random source, crypto.getRandomValues, and it is never sent over the internet or saved. You can load the page, turn off your Wi-Fi and it still works.
Does Barside see or store the passwords I make?
No. The page has no analytics and sends nothing back. The password exists only on your screen and in your clipboard after you press Copy. Keep it in a password manager, such as the one built into Barside.
How long should a password be?
Use at least 16 random characters for accounts that matter, such as email, banking and your password manager. With all four kinds of characters, 16 characters give about 103 bits, far beyond what anyone can guess. If you must type it often, a passphrase of 6 or more words is easier.
Do I need symbols in my password?
Not if the password is long. Length adds more strength than symbols: 20 small letters (about 94 bits) beat 12 characters of every kind (about 77 bits). Turn symbols on when a website demands them, and off when a website rejects them.
What does bits of entropy mean?
It is a measure of how many guesses a random password takes. Each bit doubles the number: 50 bits means about a million billion possible passwords, and 100 bits is that number squared. The tool counts bits for passwords it makes at random, which is the only case where the count is exact.
Why should I leave out look-alike characters?
Characters like a capital I, a small l and the number 1 look alike in many fonts, and so do O, o and 0. Leave them out when you have to read a password aloud or type it from paper. It costs a few bits, so add a character or two to make up for it.
Can I make a Wi-Fi password with it?
Yes. A Wi-Fi network with WPA2 personal security takes a password of 8 to 63 characters. A random 20-character password without look-alikes is strong and still possible to type on a TV or a phone.