Password Generator
This tool creates strong, random passwords, PINs and passphrases entirely inside your browser, with nothing ever sent to a server. On the Password tab you set a length from 4 to 128 characters with the slider and tick which character sets to draw from: uppercase letters, lowercase letters, numbers and symbols, plus options to exclude similar-looking characters such as 0, O and 1, and to strip spaces. Click Generate and you get a random password with a copy button and a strength meter rating it from Weak to Very Strong based on its length and character mix. The Multiple tab produces a batch of 5, 10, 20 or 50 passwords at once at a length you choose, each with its own copy button. The PIN tab creates a numeric code of 4 to 12 digits for devices, safes or bank cards. The Passphrase tab strings together 3 to 8 random dictionary words, with options to capitalise each word, add a number or symbol, and pick a separator such as a hyphen, full stop, underscore, space or none, giving you something easier to remember while still hard to guess. Every result comes from your browser's cryptographically secure random number generator, so it keeps working even offline. Use a unique password for every account, save them in a password manager, and turn on two-factor authentication wherever it is offered.
What makes a password strong?
Password strength is primarily about entropy, which is a measure of unpredictability. A password's entropy is determined by two things: how long it is, and how many different characters it could use at each position. A 16-character password using uppercase letters, lowercase letters, numbers, and symbols draws from a pool of around 90 characters. Each additional character in the password multiplies the number of possible combinations by 90. A 16-character password from this pool has approximately 90^16 (roughly 10^31) possible values, which would take billions of years to crack by brute force even with very fast hardware.
Length matters more than complexity. A 20-character password using only lowercase letters is stronger than a 10-character password using all character types. Both are far stronger than any real word or phrase with deliberate substitutions like "P@ssw0rd", which password cracking software tests within seconds.
Is this password generator safe?
Yes. All passwords generated on this page are created entirely inside your browser using JavaScript's window.crypto.getRandomValues() function where available, which is cryptographically secure. No password is ever sent to any server, stored in a database, or transmitted anywhere. You can verify this by disconnecting from the internet and the generator will continue to work. The only way this tool could be unsafe is if someone else can see your screen.
Passphrases versus random passwords
A passphrase is a sequence of random words, such as "Correct-Horse-Battery-Staple". This concept was popularised by security researcher Bruce Schneier and the webcomic XKCD. A four-word passphrase from a vocabulary of 7,776 common words (a standard wordlist) has about 51 bits of entropy, similar to a random 9-character password using mixed case and symbols. A five-word passphrase has about 64 bits, equivalent to a random 12-character password. Passphrases are often easier to remember while being genuinely strong.
How many different passwords do you need?
Every online account should have a unique password. If you reuse the same password across multiple sites and one site is breached, attackers will immediately try your password on every other major service. This attack, called credential stuffing, is one of the most common ways accounts are compromised. The solution is a password manager (such as Bitwarden, 1Password, or the one built into your browser) that stores a different strong password for every account. Use this generator to create those passwords, and store them in the manager.
Password tips for New Zealanders
The most commonly breached passwords in NZ include birthdays, suburb names, sports team names, and simple keyboard patterns. "Wallabies", "Auckland2024", and "Warriors123" are all extremely weak. IRD, MyIR, online banking, email, and the NZ government RealMe identity service are the highest-risk accounts to protect because they can affect your financial and legal identity. Use a unique 16+ character random password for each of these services, and enable two-factor authentication (2FA) wherever possible.