CODDY Tool

Password Generator

Generate strong random passwords and memorable passphrases.

Create cryptographically secure passwords with control over length and character sets, or generate word-based passphrases that are easier to remember and just as hard to guess.

Everything you enter stays in this browser tab. Nothing is sent to our servers, logged or stored.

Loading tool…

About Password Generator

The two properties that make a password strong are randomness and length. Randomness means it cannot be guessed from anything about you; length means it cannot be brute-forced in reasonable time. Human-invented passwords fail on both counts — people reuse patterns, substitute predictable characters and pick words that appear in every cracking dictionary.

These passwords come from the browser's cryptographic random number generator, the same source used for encryption keys. Values are drawn with rejection sampling so that every character in the chosen set is equally likely — a subtle detail that naive implementations get wrong by using the modulo operator, which quietly biases the output.

Passphrase mode is worth considering for anything you need to type from memory — a device unlock code, a password manager's master password. Four or five random words are long enough to be very strong and far easier to remember and type accurately than a string of symbols.

How to generate a strong password

  1. Choose a mode

    Random characters for maximum strength per character, or a passphrase when you need to remember it.

  2. Set the length and character sets

    16 characters or more is a sensible minimum. Include uppercase, lowercase, digits and symbols unless a site forbids them.

  3. Generate and check the strength

    The estimated entropy and time to crack are shown for the password you generated.

  4. Copy and store it

    Copy it straight into your password manager. The clipboard is cleared automatically after a short delay.

How long should a password be?

  • 12 characters — the practical minimum for anything that matters.
  • 16 characters — a good default for ordinary accounts.
  • 20 or more — email, banking and any account that can reset others.
  • 4–6 random words — for passphrases you have to type from memory.

Advice that still holds

  • Never reuse a password. A breach at one site is otherwise a breach everywhere.
  • Use a password manager. Remembering unique strong passwords is not a skill anyone has.
  • Turn on two-factor authentication wherever it is offered; it defeats a stolen password entirely.
  • Length beats complexity. A long passphrase is stronger than a short string of symbols.
  • Ignore mandatory rotation policies unless a breach is suspected — forced changes push people towards predictable variations.

Frequently asked questions

Are the generated passwords sent anywhere?

No. Generation happens entirely in your browser using the Web Crypto API, and nothing is transmitted, logged or stored. You can verify this by disconnecting from the network — the generator keeps working.

How random are they really?

They use crypto.getRandomValues, the browser's cryptographically secure random source, which draws entropy from the operating system. It is the same class of randomness used to generate encryption keys, and is not predictable from previous outputs.

Is a passphrase weaker than a random password?

Not if it is long enough. Each word from a large wordlist contributes roughly 13 bits of entropy, so five random words give about 65 bits — comparable to an 11-character random password, and far easier to type correctly. Six words is stronger still.

What does the strength estimate mean?

Entropy in bits measures how many guesses an attacker would need on average. Every extra bit doubles that number. Above about 80 bits, brute force is impractical with any foreseeable hardware — but this only holds for genuinely random passwords, not human-chosen ones.

Should I write the password down?

Use a password manager instead. If you must write one down, paper stored somewhere physically secure is far better than a note on your phone or a text file on your desktop.

Why does the site reject my generated password?

Some sites impose maximum lengths or ban certain symbols. Reduce the length or turn off symbols to fit their rules — and be aware that such restrictions usually indicate the site is not storing passwords the way it should.

Related tools

All Security Tools

UUID Generator

Developer Tools

Generate UUIDs in bulk — random v4 or time-ordered v7 identifiers.

QR Code Generator

URL & Web Tools

Create QR codes for links, text, Wi-Fi networks and contact details.

Base64 Encoder

Developer Tools

Encode text to Base64, with URL-safe and wrapping options.

JSON Formatter

Developer Tools

Beautify minified JSON with proper indentation and a tree view.

URL Encoder

Developer Tools

Percent-encode text for URLs, query strings and form data.

Password Generator is free to use with no account, no watermark and no usage limits. Last updated 14 August 2026.