Free secure password generator
Generate a strong random password, passphrase, or PIN in your browser. The Web Crypto API does the work on your device, so the password never reaches a server and nothing about it is logged. No account is needed, and reloading the page discards what you generated.
Copied to clipboard
An offline attacker guessing 100 billion times per second would need about longer than the age of the universe to find it.
How the secure password generator works
Set your options
Pick a password, passphrase, or PIN, then choose the length, the character classes, and whether to exclude look-alike characters. If you already have a password and only want to know how it holds up, use the password strength checker instead.
Generate
Your browser draws random bytes from the Web Crypto API, and selects characters by rejection sampling so no character is more likely than another.
Copy it
Copy the result straight into your password manager. The secret never transits the network, so it cannot be intercepted, logged by a server, or leaked in a breach of ours.
Private by design: nothing leaves your browser
Most online password generators send your settings to their servers, and some return a password the server itself chose. A password you did not generate yourself is not a secret. This one never makes a network request:
100% client-side
The password is generated on your device with the browser's Web Crypto API. No network request is made when you click Generate.
Nothing stored or logged
No account, no analytics on what you generate, no history kept. Reload the page and the previous password is gone for good.
Open and verifiable
Randomness comes from your operating system through cryptographically secure random number generator, not from cryptography we rolled ourselves.
What the generator guarantees
- Every character class you enable appears at least once in the result.
- Characters are chosen by rejection sampling, so the output carries no modulo bias.
- The final string is shuffled with Fisher-Yates, so guaranteed characters are not predictably placed at the front.
- The entropy shown is computed from your settings, not from the string on screen, which is the figure an attacker actually faces.
Where the password ends up matters as much as how it was made. A site that stores it properly keeps a salted hash and never the password itself. You can see what that looks like by running a password through bcrypt in the hash generator: hash the same password twice and the two results differ, because bcrypt takes a fresh salt every time. If you use a passphrase from here to encrypt a file or a message, that passphrase is the only thing between an attacker and the plaintext, so length is worth more than cleverness.
Built for developers and security-conscious teams
Anyone who needs a secret that no one else has ever seen, from a root credential to a Wi-Fi passphrase. The same principle drives BlockSurvey's zero-knowledge surveys: the data is protected on the device, not on somebody's server.
Developers
Generate database passwords, service credentials, and seed values without pasting them into a third-party site first.
Security & IT teams
Issue break-glass admin passwords and rotate shared credentials with a documented entropy figure you can put in a ticket.
Privacy-conscious users
Create a master password or disk-encryption passphrase you can actually remember, using the passphrase mode.
Building something that handles sensitive data?
BlockSurvey runs on zero-knowledge surveys, so the responses you collect are never sold or mined. The forms work the way this generator does, with the encryption happening on the respondent's device.
More free privacy tools
Browse all privacy tools
These tools run in your browser because that is how we build everything. The same idea, applied to research: privacy-first surveys with end-to-end encryption.