We would like to count page views and clicks with Google Analytics, which sets cookies in your
browser. It is how we learn which pages are worth writing. Nothing loads until you choose, and
declining costs you nothing on this site. What we collect.
Random characters or random words, generated on your device, with an honest strength estimate instead of a checkbox rule.
Generate
…
Check strength
—
Estimated with zxcvbn-ts locally. Nothing is sent.
Everything on this page runs in your browser. We do not log what you check, and no result — no address, no email, no speed figure — leaves your device. Analytics records that the tool was used, never what it returned. Privacy policy. Tool last reviewed 2026-09-06.
What "strong" actually means
A password is strong if the number of guesses needed to find it is larger than an attacker can make. Offline, against a stolen database of fast hashes, that is billions of guesses per second; online, against a login form, it is a few per second before lockout. Sixteen random characters from a 90-symbol set give about 1031 possibilities; five random words from a 7,776-word list give about 1019. Both are far past offline cracking for the foreseeable future. "Summer2026!" is found in seconds because crackers try words, years and symbols in exactly that pattern first.
Why the strength meter here is different
Most sites rate by rule: an uppercase, a number, a symbol. zxcvbn rates by how a cracker would actually search — dictionaries, names, keyboard walks, dates, leetspeak, repeats — and reports the estimated guesses and the time at several attack speeds. It is why "P@ssw0rd" scores badly and "purple-tractor-ninety-lamp" scores well.
Where this fits with a VPN
Nowhere, directly — a VPN protects the connection, not the account. The point of hosting this on a VPN site is that people arrive here worried about privacy, and reused passwords are a larger real-world risk than any ISP. Check whether your email is in a breach next door, and use a manager.
Frequently asked questions
How long should a password be?
For anything that matters, 16 characters or more of random characters, or a passphrase of five or more random words. Length beats complexity: "correct horse battery staple" style phrases are both stronger and easier to type than "P@ssw0rd1!". The strength meter on this page estimates how many guesses an attacker would need using real cracking patterns, not just character counts.
Is this generator secure?
It uses the browser's cryptographic random number generator (crypto.getRandomValues), runs entirely on your device, and never sends anything. The page works offline once loaded. We cannot see what it generates.
Passphrase or password?
A passphrase for anything you type by hand — your master password, laptop login, Wi-Fi. A random character string for anything a password manager fills for you. Both, at the lengths here, are far beyond what can be brute-forced.
How does the strength check work?
It runs zxcvbn, the estimator developed at Dropbox, locally in your browser. It recognises dictionary words, names, keyboard patterns, dates and common substitutions, and estimates how many guesses a cracker would need. It is more honest than the "one uppercase, one symbol" rules, which rate "Password1!" as strong.
Should I check my real password here?
You can — nothing leaves your browser — but the better habit is to never type a real password into a page that is not the login for that service. Check a candidate, not the one you use.
What about a password manager?
Use one. Bitwarden (open source, audited, free tier) or 1Password are the usual recommendations, and Apple's built-in Passwords app is fine on Apple devices. A VPN does nothing for password security; a manager does almost everything.