masstree.inPassword Generator & Strength Checker
Random passwords, memorable passphrases, and an honest estimate of how long a password would survive a brute-force attack. Generated on your device only.
Runs in your browser — nothing is uploaded or stored on a server.
Generate
Choose your options and press Generate — nothing is made until you ask.
Check a password
Good habits
- Use a different password for every account and keep them in a password manager.
- Turn on two-factor authentication for e-mail, banking and anything with a card on file.
- Length beats complexity: 16 random characters or 5 to 6 random words.
- Never reuse the password of your e-mail account anywhere else.
Questions
Is it safe to generate a password on a website?
Here, yes: the passwords come from your browser's crypto.getRandomValues, are never sent anywhere and are not stored. You can check the page source, or disconnect from the internet and it still works.
Password or passphrase?
A 16-character random password is stronger per character, but a six-word passphrase like Copper-Lantern-Falcon-Meadow-Quartz-Ember is easier to type and remember, and still has around 55 bits of entropy from this list. Use random passwords inside a password manager and a passphrase for the manager itself.
How is strength worked out?
From entropy: the length times the log of the number of possible characters, with penalties for repeats, keyboard runs and common words. Crack time assumes an offline attack at ten billion guesses a second, which is what a modern GPU rig manages against a weak hash.
Does the checker store what I type?
No. The check runs in the page with plain JavaScript and the text never leaves the input box. Still, avoid typing a password you already use into any website that is not the one it belongs to.