Password Generator
Create a strong, cryptographically random password or a memorable Diceware-style passphrase, or check how strong your own password is. Everything happens in your browser. Nothing leaves this page.
How is this worked out?
- Offline attack assumes someone has stolen a website’s password database and is guessing at 10 billion a second on powerful graphics cards.
- Online attack assumes they’re guessing on a login page that only allows about 100 tries an hour.
- Both times are the average, which means getting through half of all the possible passwords. Each extra random character multiplies the work, by about 94 times with all character types on.
- These times hold for truly random passwords. When you check your own, the tool lowers the estimate for words, dates, keyboard patterns and common passwords, because cracking tools try those first.
- In real life the bigger risk is a password being leaked or reused, so use a different one for every site.
Handy when a site won’t accept certain symbols. Anything you type here is left out of every password. Capitals count, so O and o are different.
Uses your browser’s cryptographic random generator. Nothing is stored.
Batch
Check your own password
Type or paste a password to see how strong it is. It’s checked on this page as you type and never sent, saved or logged.
How is this worked out?
- Offline attack assumes someone has stolen a website’s password database and is guessing at 10 billion a second on powerful graphics cards.
- Online attack assumes they’re guessing on a login page that only allows about 100 tries an hour.
- Both times are the average, which means getting through half of all the possible passwords. Each extra random character multiplies the work, by about 94 times with all character types on.
- These times hold for truly random passwords. When you check your own, the tool lowers the estimate for words, dates, keyboard patterns and common passwords, because cracking tools try those first.
- In real life the bigger risk is a password being leaked or reused, so use a different one for every site.
This session
How to use the Password Generator
- Set Password Length. The field starts at 16 and accepts anything from 6 to 128 characters.
- Click Generate Password.
- The random string appears in the result box. Select it and copy it to your password manager or to the account you are setting up.
- Click Generate Password again if you want a different string of the same length.
If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi
What it is for
A password you invent is usually a word, a year or a keyboard pattern: easy for you to remember, and easier than it should be for someone else to guess. This generator builds a fresh string from mixed uppercase letters, lowercase letters, digits and symbols such as ! @ # $ % ^ & *. Every type is switched on by default, so each password includes that spread. You can untick any type, add extra characters of your own, or exclude characters a site will not accept.
Sixteen characters is a sensible default for most new accounts. Go longer (up to 128) for a password manager vault or a high-value login. The six-character minimum exists because the field needs a floor, not because six characters is a good password. Prefer the default or above. Generate a unique string for each account; reusing one password is how a single leak opens the rest.
Store the result in a password manager rather than a notepad on the desktop. Catpool does not keep what you generate. If you also need an unguessable number (a PIN-style pick, not a login secret), the Random Number Generator is the simpler cousin.
Why it runs in your browser
Generation is instant and local. The page states that passwords are never stored by Catpool. That is the point of a browser tool: you can mint a secret for a real account without sending it to someone else’s vault.
Common questions
Can I choose which character types to include?
Yes. Tick or untick uppercase, lowercase, digits and symbols, and add extra characters of your own if you like.
Can I leave out certain symbols?
Yes. Type them into Exclude these characters, for example "'\`{} if a site rejects quotes or brackets. They are removed from every set, including your extra characters, and the strength meter works from the smaller pool that is left. Capitals count, so excluding O does not remove o. If you exclude every symbol, the password simply has none and the tool tells you so.
How long should the password be?
Use 16 unless the site demands otherwise. Longer is stronger. Stay inside 6 to 128, which is what the length field allows.
Is the result saved anywhere?
No. Closing the tab clears it. Copy it into a manager before you leave if you intend to use it.
Why does it look unreadable?
That is deliberate. A string you cannot turn into a word is harder to guess. Let a password manager remember it; you should not have to.
Should I reuse a generated password on several sites?
No. Generate a new one for each account. Reuse is the failure, not the alphabet.
Related: Security, Random Number Generator, About.
Related tools
Has My Password Been Leaked?See if a password has turned up in a known data breach.Security
Two-Factor Code GeneratorMake live 2FA codes from your own setup key, for testing and recovery.Security
Random Number GeneratorFair random numbers for draws and tests.Calculators
Photo X-RayStrip the hidden location from a photo before you share it.Security