Strong password generator
Create cryptographically strong passwords and passphrases with a live entropy meter. Everything runs in your browser via the Web Crypto API — no server, no sign-up.
Your password will appear hereTime to crack (offline GPU): heat death of the universe
Settings
History (this session)
Generated passwords will appear here.
Why PassVault
Cryptographic generation
Passwords come from crypto.getRandomValues — the operating system's CSPRNG — not a predictable Math.random. Every character is drawn with true randomness.
Fully offline
There is no backend. Generation, entropy scoring and history all run in your browser, and nothing is ever sent over the network or stored on a server.
Live entropy meter
See real strength in bits and an estimated crack time as you tweak length and character sets, so you can tell a truly strong password from a merely long one.
Passphrases & bilingual
Prefer memorable passphrases? Generate Diceware-style word combinations in English or Russian. The whole site is fully bilingual, switchable anytime.
Strong passwords, generated the right way
PassVault is a free online password generator built for one job: producing passwords that are genuinely hard to guess. It draws every character from the Web Crypto API's cryptographically secure random number generator — the same source browsers use for encryption keys — so the results are unpredictable in a way that ordinary random functions are not. A live entropy meter shows the real strength of each password in bits, together with a rough estimate of how long an offline GPU attack would take to crack it.
Everything runs client-side in your browser, which makes it fast, private and available offline once the page has loaded. There is nothing to install and nothing to sign up for — your passwords are never transmitted or stored on any server. Fine-tune the length and character sets, exclude look-alike characters like 0/O and 1/l/I for passwords you have to type by hand, or switch to passphrase mode for memorable Diceware-style combinations in English or Russian. Whichever you choose, each generator is backed by plain-language guides that explain the security thinking behind it.
Guides & articles
Plain-language explainers on passwords, entropy and staying secure online.
What Makes a Password Strong
Length, randomness and uniqueness — not clever substitutions — are what actually make a password hard to crack. Here's how each one works.
Password Entropy Explained
Entropy is the one number that objectively measures password strength. Learn the formula, what the bits mean and how to read a crack-time estimate.
Passphrases vs Passwords: Which to Use
Random character strings and multi-word passphrases can be equally strong. The difference is where you use them and whether you have to remember them.
Frequently asked questions
How does PassVault generate random passwords?+
PassVault uses the browser's Web Crypto API — crypto.getRandomValues() — which reads from the operating system's cryptographically secure random number generator. Unlike the predictable Math.random(), this source is designed for generating encryption keys. Each character is chosen by drawing a random 32-bit integer and mapping it onto the selected character set.
Are the passwords I generate stored anywhere?+
No, never. PassVault has no backend, database or analytics. Every calculation happens in JavaScript on your device, and passwords exist only in the browser's memory during your session — they vanish when you close or reload the tab. The session history lives in a plain variable, not in localStorage, cookies or IndexedDB. You can confirm this in your browser's Network tab: generating a password makes no requests.
What is password entropy and how is it measured?+
Entropy is a measure of a password's randomness in bits — how much uncertainty an attacker faces when guessing it by brute force. The formula is H = L × log₂(N), where L is the length and N is the size of the character set. Lowercase-only (N=26) gives 4.7 bits per character; a full 95-character set gives about 6.6. A practical minimum for a strong password is 80 bits; for critical accounts, aim for 100 or more.
Why should a password be at least 16 characters?+
Modern GPU clusters can try billions of passwords per second against weak hashes. An 8-character password from the full ASCII set falls in days; 12 characters buys millions of years; 16 characters pushes the search space beyond anything physically feasible (~10²² years). The old 8-character rule is dangerously outdated — NIST now treats it as an absolute floor and recommends 15 or more.
What's the difference between a random password and a passphrase?+
A random password is a sequence of random characters (k#9Xm2@vR5qL) with high entropy per character but hard to memorise. A passphrase is several random words joined by a separator (amber-focus-cluster-tiger). With enough words — 5 or 6 from a large list — a passphrase reaches high entropy while staying far easier to remember and type. PassVault generates both; switch to the Passphrase tab and use 5–6 words for a good balance.
How should I store the passwords I generate?+
Use a dedicated password manager: Bitwarden (open-source, generous free tier), KeePassXC (fully offline, encrypted .kdbx file), Proton Pass or 1Password. Never keep passwords in plain text files, notes or spreadsheets, and don't rely on a browser's built-in store without a strong master password. A manager lets every account have a unique, strong password without you memorising any of them.