Free tool
Password generator random, strong, made.
Random passwords or memorable passphrases from a cryptographic random source.
Generated from a cryptographic random source.
Password generator at a glance
content.win generates passwords from a cryptographic random source, and never stores them.
- Works with
- Your choice of length, symbols, numbers, or a memorable passphrase.
- Comes back as
- A random password or passphrase, with a strength estimate.
- Runs
- In your browser.
- Limits
- No limit.
- Price
- Free. No account.
How to generate a strong password
- Pick a length. Twenty characters is the default and a good floor. Go longer wherever the site allows.
- Choose the characters. Keep all four sets on unless a site rejects symbols. Skip look-alikes if you'll ever read it out or type it by hand.
- Copy it into a password manager. Then close the tab. There is nothing to clear, because nothing was saved.
What the options do
- Password
- Random characters drawn from the sets you tick. Every position is independent, and at least one character from each ticked set is guaranteed, so a site's "must contain a number" rule is always met.
- Passphrase
- Random words from the EFF short word list, 1,296 common words chosen to be easy to spell and hard to confuse. Six words give about 62 bits of entropy, the same as a 10-character random password, and you can actually remember them.
- Strength meter
- Shows entropy in bits and how long a fast offline attack would take at 100 billion guesses a second. Anything past 80 bits is out of reach for the foreseeable future.
- Skip look-alikes
- Removes 0, O, 1, l, I and the vertical bar so what you read is what you type.
Why this is safe to use
- Nothing is sent to a server, written to storage, or kept after you leave. Open the network panel if you want to see for yourself.
- The page has no sign-up, no cookies of its own and no third-party scripts beyond analytics on page views.
Questions people ask
Is an online password generator safe to use?
You can open the page, switch off your connection and it still works. Nothing is sent, logged or stored anywhere.
How long should a password be?
Sixteen characters or more for anything that matters, and longer if the site allows it. Length beats cleverness: every extra random character multiplies the work an attacker has to do. The default here is 20.
Password or passphrase?
A passphrase of six random words is as strong as a 10-character random password and far easier to type from memory. Use passphrases for the few things you type by hand, like your computer login and your password manager, and random passwords for everything a manager fills in for you.
Do I need symbols?
Not for strength, if the password is long. Symbols mainly exist to satisfy sites that require them. Turn them off if a site rejects them or you need to type the password on a TV remote.
What does "skip look-alikes" do?
It leaves out characters that are easy to confuse when read or copied by hand: the digit 0 and the letter O, the digit 1, lowercase l, uppercase I and the vertical bar. Strength drops by a hair; mistakes drop by a lot.
How is the strength calculated?
From entropy: the number of possible characters raised to the length, expressed in bits. The crack time assumes an attacker who has stolen the password database and can test 100 billion guesses a second, which is what modern hardware manages against weak hashing. Real sites with slow hashing are far safer than this estimate.
How random is it?
It uses the browser's cryptographic random number generator, the same source used for encryption keys. Picks are made with rejection sampling so no character is more likely than another.
Should I still use a password manager?
Yes. Generate here if you want, but store it in a manager. Reusing even a perfect password across sites is the mistake that gets accounts taken over.