Choose length and character options to generate a password — it is created locally in your browser and never sent anywhere.
How it works
- Random mode uses
crypto.getRandomValues(), the browser's cryptographically secure random number generator — notMath.random(). - Pronounceable mode alternates consonant and vowel sounds so the result is easier to read aloud or memorize, at the cost of somewhat lower entropy per character — it's a reasonable trade-off for passwords you'll type manually rather than store in a password manager.
- "Exclude similar characters" removes lowercase L, uppercase I, and the digits 0/1 — useful when a password might need to be typed from a printed card.
- Entropy is calculated as
length × log₂(character set size). Above ~80 bits is considered strong for most purposes. - Nothing here is logged, stored, or sent to a server — refresh the page and it's gone.
How to use a generated password well
A generated password is useful because it removes the need to invent something that merely looks random. The important part is what you do with the result afterwards.
Start with uniqueness. A password that is strong on paper becomes a much worse choice when the same password is reused on another account. If one service is breached and the password is exposed, attackers can try that same credential elsewhere.
Length is also important. When a service accepts long passwords, a 16-character random password is a reasonable starting point, and longer passwords can provide an even larger search space. You do not need to make a long random password "more complex" by manually adding patterns that you can predict.
The practical problem is remembering the result. A password manager is usually a better place to store a long random password than a notebook, browser tab, spreadsheet or personal note. The point of a password generator is to produce something you do not have to remember.
Do not treat the crack-time estimate below the generator as a promise about a real account. The estimate describes a simplified guessing scenario. Real accounts are protected by a combination of password hashing, rate limits, multi-factor authentication and other controls, while compromised databases may also give attackers very different conditions.
Finally, protect the password after generating it. Do not paste it into unnecessary websites just to test it, and do not reuse it simply because a previous account accepted it.
Learn how to create a strong password you can actually use →
Frequently asked questions
How long should a generated password be?
For most accounts, a long unique password is the useful default. A 16-character random password is a strong starting point; increase the length when a service allows it. A password manager makes longer passwords practical because you do not need to memorize them.
Is the password sent to AllDays?
No. The password generator creates the value in your browser using browser-side cryptographic randomness. The generated password is not submitted to an AllDays password-generation server by the core generator workflow.
Is a passphrase as good as a random password?
It can be. A passphrase needs enough length and genuinely unpredictable word selection. A long random password is often easiest when a password manager is available. A memorable passphrase can make sense when you actually need to type the secret yourself.
What does the crack-time number mean?
It is an estimate for a hypothetical offline guessing attack using the assumptions shown by the tool. It is not a prediction of how long an attacker would need to compromise a particular website account because rate limits, password hashing, leaked credentials, multi-factor authentication and attack strategy change the real situation.
*Estimated for an offline attack at 10 billion guesses/second (high-end GPU rig against a fast hash). Online attacks are millions of times slower.
Why length matters most
Each character you add multiplies the number of possible passwords, and that growth is what makes a password hard to guess by brute force. With 62 possible characters (lowercase, uppercase, and digits), an 8-character password has 62^8 combinations — about 218 trillion. Adding just two more characters raises that to 62^10, roughly 839 quadrillion. Length buys far more security than swapping a letter for a symbol.
Character sets and the search space
The set of characters you allow sets the base of that exponent. Digits alone give a base of 10; adding letters and symbols pushes it past 90. A longer password from a smaller set often beats a short one from a large set, because length is the exponent and the character set is only the base.
How the randomness here works
This generator draws its characters from your browser's cryptographic random source (the Web Crypto API), not from an ordinary pseudo-random function. That matters: a predictable generator can produce guessable output even when the password looks complex. Everything is generated on your device.
Habits that actually help
A truly random 16-character password is stronger than a clever-looking one built from a word and a predictable substitution like "P@ssw0rd". The biggest real-world weakness isn't length, though — it's reuse. A unique password per account limits the damage if any single site is breached.
Why password length became central
The number of possible random strings grows exponentially with length. With 62 possible letters and digits, eight positions allow 62^8 = 218,340,105,584,896 combinations.
Humans are poor random generators
People naturally choose patterns, words and meaningful dates. Computer-generated random strings can avoid many of those predictable choices when the randomness source is appropriate.