Secure Password Generator
Create up to 50 strong passwords at once, anywhere from 4 to 1500 characters, or switch to memorable passphrases. Everything is generated with a cryptographic random source, nothing is stored, and no account is needed.
How to use the generator
The default settings already produce a password that is strong enough for almost any account: 16 characters drawn from the full keyboard, which works out to about 103 bits of entropy. You only need to change something if the site you are signing up to imposes its own rules.
- Pick a length. Sixteen characters is the sensible default. Go to 20 or 24 for a bank, an email account or anything that unlocks other accounts. Very long values exist for people who need API keys, database secrets or random filler text.
- Pick how many you want. Generating a batch is useful when you are setting up several accounts in one sitting, or when you want a few candidates to choose from.
- Adjust the composition if you have to. Some sites still reject symbols. Untick the special characters box and add a couple of characters to the length to compensate.
- Tick "exclude look alike characters" if you will have to read the password off a screen and type it on another device. It removes l, 1, I, O and 0, which are the ones people get wrong.
- Tick "easy to remember" if you need to keep the password in your head. You will get a passphrase built from a 2048 word list instead of a random string.
Why 16 random characters is the number to remember
Password strength is measured in bits of entropy, which is just a compact way of saying how many guesses an attacker has to make on average. Each extra bit doubles that number. The table below assumes an offline attack running at one trillion guesses per second, which is what a well funded attacker with a rack of modern GPUs can reach against a fast, badly protected hash.
| Length | Lowercase only | Letters and digits | Full keyboard |
|---|---|---|---|
| 8 characters | instant | 2 minutes | 55 minutes |
| 10 characters | 1 minute | 5 days | 11 months |
| 12 characters | 13 hours | 51 years | 9 thousand years |
| 14 characters | 1 year | 196 thousand years | 77 million years |
| 16 characters | 691 years | 755 million years | 697 billion years |
| 20 characters | 316 million years | beyond reach | beyond reach |
Two things jump out. Length buys far more than variety: going from 12 to 16 lowercase letters helps more than adding symbols to a 12 character password. And the cliff is steep. Eight characters was fine in 2005 and is worthless today, because the guessing rate has grown by orders of magnitude while passwords stayed the same length.
These numbers are the ceiling, not the floor. They only hold if the password is genuinely random. A password you invented yourself has far less entropy than its length suggests, because cracking tools model the way people think: a capital at the start, a digit and an exclamation mark at the end, a keyboard walk, a date of birth, a pet's name. Our page on password strength goes through how that estimate is made.
Random password or passphrase?
Both are on this page, and they solve different problems.
A random password is the right answer for every account that a password manager will remember on your behalf, which should be nearly all of them. You never type it, so it does not matter that it is unreadable. Sixteen to twenty characters, unique per site, and you are done.
A passphrase is the right answer for the handful of secrets you actually have to type from memory: the master password of your password manager, the encryption passphrase of a laptop, the PIN protecting a hardware key. Tick the "easy to remember" box and the generator produces something like Harbor-Lantern-Copper-Meadow-Trellis-Quartz-47. Each word is drawn from a list of 2048 words, so each word contributes exactly 11 bits. Six words is 66 bits, which is comfortably beyond what an offline attack will chew through, and it is a great deal easier to retype on a television remote than a random string.
The critical detail is where the randomness comes from. A passphrase you compose yourself from words you like is weak, because the words are not independent and the pool you draw from is small. The generator picks each word with a cryptographic random source, which is what makes the arithmetic honest. The full comparison is here.
What this site does not do
It does not ask for your name, your email or an account. It does not keep the passwords: they are generated for the page view that shows them and are gone as soon as the response is sent. There is no log file of generated values, no database table, and nothing handed to a third party. The site runs over HTTPS with HSTS, so nothing travels in the clear.
It also does not try to be your password manager. Generating a password is the easy half of the problem. Storing it, syncing it between devices and filling it in without typing is the half that decides whether you actually keep unique passwords, and that needs a dedicated tool.
Frequently asked questions
Is Createpass.net really free?
Yes. There is no account, no installation and no limit on how many passwords you generate. The site is funded by advertising, which is why you see ad slots on some pages.
Are my generated passwords stored or logged?
No. Each password exists only for the page view that displays it. It is not written to a log, a database or a file, and it is not sent anywhere else. If you close the tab without copying a password, it is gone.
Is it safe to generate a password on a website at all?
It is a reasonable trade off for most people, and it is far safer than reusing a password you already have. If you are protecting something where the consequences of a compromise are severe, generate the password inside your password manager or with an offline tool instead, so the value never crosses a network. The regenerate button on the results page is a middle ground: it rebuilds the password in your own browser using the Web Crypto API, so that value never leaves your machine.
How long should my password be?
Sixteen random characters covers almost everything. Twenty or more for email, banking and anything that can reset other accounts. NIST SP 800-63B, revision 4, asks for at least fifteen characters when the password is the only authenticator, and asks systems to accept at least 64 so that passphrases fit.
Do I need to change my passwords every three months?
No, and current guidance actively advises against it. Forced rotation pushes people towards predictable variations such as Summer2025! becoming Autumn2025!, which is easier to guess, not harder. Change a password when there is a reason: a breach notification, a shared device, a password you know you reused. Otherwise a long unique password can stay in place. More on when to change a password.
Why does the site ask me to exclude look alike characters?
It does not ask, it offers. If you will read a password off one screen and type it on another, removing l, 1, I, O and 0 saves you the frustration of failed attempts. It costs about 0.25 bits per character, which is negligible at 16 characters and above.
A website rejects the password I generated. What now?
Almost always because of a symbol it does not accept, or a maximum length below what you generated. Untick the special characters box, or lower the length, and add a few characters back to compensate. A site that caps passwords at 12 characters or forbids symbols is telling you something about how it stores them, so treat that account as lower trust and never reuse its password.
Can I generate more than 50 passwords at once?
Not in one request, but you can submit the form again as many times as you like. Each batch is independent and drawn fresh from the random source.