Password & Passphrase Generator
Generate a strong random password or a passphrase that is easier to type and remember. Everything happens in your browser. Nothing you generate is sent anywhere.
A genuinely random password or passphrase.
Password reuse and weak, guessable passwords remain one of the easiest ways into a business account, not because attackers are clever, but because a large share of real-world passwords follow predictable patterns, a word, a year, a keyboard walk, that automated cracking tools test first. A genuinely random password or passphrase closes that door.
This tool generates one for you, entirely inside your browser, using your browser's cryptographically secure random number generator. Nothing you generate here is transmitted anywhere or stored on a server, it exists only on your screen until you copy or download it. Switch between a random password, best when you can store it in a password manager and never have to type it, or a passphrase, several real words strung together, better when someone actually has to type the result by hand, for Wi-Fi, a shared device, or a one-time setup.
Presets are included for common situations: a general recommended default, Microsoft 365, older Windows systems with legacy character restrictions, Wi-Fi passwords, and short numeric PINs. Adjust length and which character types to include, then generate as many as you need.
The strength rating and estimated crack time above update as you adjust the settings, aim for "very strong" whenever the account allows a password that long.
A genuinely random password, generated locally.
This tool uses your browser's cryptographically secure random number generator (window.crypto) to build a password from the character sets you choose. Nothing is sent to a server. The password is created and stays entirely on your device, in your browser tab.
Common mistakes
Reusing a strong password everywhere. A strong password only helps when it is unique. Generate a new password for every account and store it in a password manager.
Making it memorable by pattern. A word plus a year, a company name plus a symbol, or keyboard walks like qwerty123 are easy for attackers to test.
Making passwords too short. Length usually matters more than complexity. For most business accounts, start at 20 characters when a password manager is available.
Ignoring passphrases. If someone has to type the password manually, a longer passphrase is often better than a shorter complex password.
Password generator FAQ
Is this password generator safe?
Yes. The password is generated locally in your browser using window.crypto. It is not submitted to Define Edge or any other server.
Should I use a password or a passphrase?
Use a random password when you can store it in a password manager. Use a passphrase when someone has to type it manually, such as for Wi-Fi, a shared device, or a temporary setup.
How long should a password be?
For most business accounts, 20 characters is a good default. For Wi-Fi, service accounts, and shared admin credentials, go longer when the system allows it.
Why does this show entropy?
Entropy is an estimate of how much guessing resistance the password has. Higher is better. It is not a guarantee, but it is useful for comparing password strength.
How is the entropy number calculated?
Entropy = length × log₂(size of the character pool actually used), e.g. a 16-character password using upper, lower, numbers, and symbols draws from a 95-character pool: 16 × log₂(95) ≈ 105 bits. This is standard Shannon entropy for a uniformly random string, and it's the same measure NIST SP 800-63B uses for algorithmically-generated secrets (as opposed to human-chosen ones, which need a different, more conservative estimate since people don't pick characters randomly). Passphrase mode uses the same formula against the word list size instead of a character pool.
What does "offline attack" time assume?
It's a worst-case estimate: an attacker who already has the password's hash and is guessing with modern offline hardware at roughly 10 trillion guesses per second, far faster than anyone guessing through a login screen. Treat it as a floor, not a promise.
Do strong passwords replace MFA?
No. Use strong unique passwords, a password manager, and MFA. Passwords are only one layer.