# Password Generator

> Generate strong random passwords or memorable passphrases. Length, character classes, bulk mode — all local.

- URL: https://generate.now/password
- Category: identity
- Price: free, no account required
- AI-powered: no
- Last updated: 2026-08-27

## What it does

Two modes: random passwords with configurable length and character classes (upper, lower, digits, symbols), or XKCD-style passphrases built from a wordlist. Generate one or hundreds at a time. Every byte of randomness comes from the Web Crypto API; nothing leaves your browser.

## When to use it

- Generate a strong password for a new service
- Build a memorable passphrase for a master password
- Bulk-generate test passwords for a load test or fixture
- Quickly rotate a credential without leaving the browser

## Examples

### 20 chars, all classes

```
T7%dKp9!Lv3@Qx2&Wm8z
```

Cryptographically random, includes upper, lower, digit, symbol.

### passphrase, 5 words, hyphen separator

```
stellar-amber-quiet-cobalt-river
```

Memorable but ~64 bits of entropy.

### 32 chars, letters and digits only

```
k7Rm2QpXvL9dTyN4wBzH6cJfA3sEuG8r
```

For systems that silently truncate or reject symbols — still roughly 190 bits.

### passphrase, 7 words, space separator

```
cobalt lantern quiet meadow bronze drift wren
```

Around 90 bits of entropy, and typeable on a phone or a TV remote.

## Frequently asked questions

### Are these passwords safe to use?

The randomness comes from window.crypto.getRandomValues — the same source recommended for security-sensitive use in the browser. Passwords never leave your device.

### Random or passphrase?

Random passwords pack more entropy per character. Passphrases are dramatically easier to remember and type. For a master password you'll type weekly, passphrases win. For a vault entry, random.

### How many bits of entropy do I need?

≥80 bits is comfortably safe for anything not nation-state targeted. The tool shows entropy live so you can size length to your threat model.

### Should I still require symbols and mixed case?

NIST SP 800-63B dropped composition rules in its current guidance. They push people toward predictable substitutions — Password1! and its variants — while adding little real entropy. Length plus a blocklist of known-breached passwords does far more, which is why the passphrase mode here defaults to five words.

### Do passwords need to be rotated every 90 days?

NIST advises against scheduled rotation. Forced expiry makes people iterate — spring2026, summer2026 — which is easier to guess than the original. Rotate on evidence of compromise instead: a breach notification, a shared credential, or someone leaving the team.

### Does anything I generate here leave the browser?

No. Every byte comes from crypto.getRandomValues() in your own browser, and no generated password is sent anywhere, logged, or stored. You can confirm it by generating with the network tab open, or by loading the page and then going offline.

## References

- [SP 800-63B: Digital Identity Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html) — NIST. Current guidance on password length, composition rules, and why rotation requirements backfire.
- [Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) — OWASP. How a generated password should be hashed once it reaches your server.
- [Crypto.getRandomValues()](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues) — MDN Web Docs. The randomness source used, rather than Math.random().

## Related tools

- [PIN Generator](https://generate.now/pin): Generate 4, 6, or 8-digit PINs that avoid obvious patterns like 1234, 0000, or birthdays.
- [API Key Generator](https://generate.now/api-key): Strong API keys and secrets with prefix support — sk_test_, pk_live_, or your own. Configurable length and charset, bulk mode.
- [Hash Generator](https://generate.now/hash): Hash a string with MD5, SHA-1, SHA-256, SHA-512, or bcrypt. Compare two hashes side by side.