F09 TechFree Tools
Start assessment

Free tool · No sign-up

Free Password Generator

Create strong, random passwords, easy-to-type passphrases and PINs. Everything is generated on your device and never sent anywhere.

Password type

Generated on your device with your browser's secure random number generator. Never sent or stored. Passphrases use the EFF long word list (CC BY 3.0).

Already have a password? Check how strong it is →

How to create a strong password

  • Make it long. Length matters more than anything else. Aim for 15 or more characters, or at least four random words.
  • Make it random. People are predictable. Names, dates, places and swaps like @ for a are the first things attackers try. Let a generator choose.
  • Use it once. When one site is breached, attackers try the same email and password everywhere else. A unique password for each account stops that.
  • Store it in a password manager. Then you only have to remember one strong passphrase.
  • Turn on multi-factor authentication. Even a stolen password isn't enough to get in when a second factor is required.

Random password or passphrase?

Random password

A string like q7#Vd!x2Lm@9Rt4e. It packs the most strength into the fewest characters, which makes it the best choice for passwords your password manager fills in for you.

Passphrase

Random words like Canopy-Gravel-Mascot7-Unify-Ladle. It's easier to remember and to type on a phone, so use one for the few passwords you enter by hand: your computer, your phone and your password manager.

PIN

Digits only. Use a PIN only where the device locks after a few wrong guesses. Avoid birthdays, repeated digits and patterns like 123456.

Frequently asked questions

Is it safe to use an online password generator?

This one is. Passwords are created on your own device with your browser's cryptographically secure random number generator (crypto.getRandomValues). They are never sent over the internet, never stored, and disappear when you leave the page.

How long should my password be?

At least 15 characters for accounts protected only by a password, and longer is better. NIST's current guidelines put length ahead of complexity rules. A random 16-character password or a 5-word passphrase is far beyond what attackers can guess.

Is a passphrase as secure as a random password?

Yes, when the words are chosen at random. Each word from the EFF word list adds about 13 bits of strength, so five random words give about 65 bits, and adding a number pushes it higher. Passphrases are easier to type and remember, which makes them ideal for passwords you enter by hand, like your computer login or password manager.

Should I use symbols in my password?

Symbols add some strength, but length adds much more. Leave symbols on unless a website rejects them. If a site has strict rules, turn off symbols and make the password a few characters longer.

How often should I change my passwords?

Only when there's a reason, such as a data breach or a sign someone else got in. Current NIST guidance advises against forced regular changes, because they push people toward weaker, predictable passwords. Use a unique password for every account instead.

How do I remember all these passwords?

Use a password manager. It generates and stores a unique password for every account, so you only need to remember one strong passphrase. Turn on multi-factor authentication for the password manager and your email accounts.

More free tools