Password Generator, Analyzer & Breach Checker

Free password generator, analyzer and breach checker

This all-in-one security utility creates strong random passwords, XKCD-style passphrases, usernames and unique email aliases. The Check my Password tab can inspect a password you already have, explain its estimated strength and check whether it appears in known breach data. Generation and analysis happen locally in your browser.

• Long and batch passwordsGenerate 4–2,048 characters or create up to 100 passwords at once.
• Advanced password rulesSet character types, minimum counts, prefixes, suffixes and duplicate restrictions.
• Selection-aware actionsSelect one, several or all passwords to copy, print or download as TXT.
• Local QR code exportsView, print or download password QR codes as PNG or SVG at multiple DPI settings.
• Check any passwordReview estimated strength, distribution, entropy, diagnostics, brute-force time, collision probability and a heatmap.
• Private breach checksCheck Pwned Passwords using only a five-character hash prefix, with anonymous replies cached locally for 24 hours.
• More credential formatsCreate XKCD-style passphrases, random usernames and email aliases.

Customize and generate secure passwords

Choose a password length from 4 to 2,048 characters and include uppercase letters, lowercase letters, numbers and symbols. The Minimum Numbers and Minimum Special Characters sliders guarantee the amount required by a website's password rules.

Open Advanced Options to remove similar characters such as I, l, 1, O and 0; prevent duplicate characters; insert a memorable word; or make every password begin or end with chosen text. The quantity slider can generate 1 to 100 passwords. Multiple results appear in a table that you can copy, print or download as a plain-text TXT file.

Check password strength and known breach exposure

Open Check my Password and enter a password to see its estimated strength and detailed analytics. The report includes character distribution, observed Shannon entropy per character, lightweight randomness diagnostics, brute-force time estimates, collision probability and a color-coded character heatmap. This analysis runs locally as you type; it does not send the password anywhere.

Select Check for breach to compare the password with the Pwned Passwords database. Your browser creates a SHA-1 fingerprint locally and sends only its first five characters. The service returns a large group of possible suffixes, and your browser performs the exact comparison on your device. The password and complete fingerprint are never sent.

To avoid unnecessary repeat requests, the anonymous range reply is cached on your device for up to 24 hours. The cache keeps the 100 most recently used replies and never stores the password, its complete hash or the selected match. A “no match” result means the password was not present in the current data returned by the service; it is not a guarantee that the password is strong, private or safe to reuse.

Create memorable XKCD-style passphrases

The passphrase generator combines 3 to 12 unrelated words from curated dictionary data. Choose a hyphen, period, underscore, space or no separator; capitalize each word; and optionally add a random number. Proper nouns are excluded, while filters for offensive words and extremely obscure dictionary terms can be switched on or off. The result includes an estimated entropy score to help compare passphrase strength.

Generate usernames and unique email aliases

Create a random word username with optional capitalization and a number. You can also enter an existing email to make a plus-addressed email alias, such as [email protected], or enter a domain with catch-all email enabled to create a unique address. Email aliases can help organize sign-ups and identify which service received an address, but support for plus addressing depends on your email provider.

Why use a QR code for a password?

Select QR Code to turn a password, passphrase, username, email alias or password list into a high-contrast black-on-white QR code. A QR code is useful when moving a long password to another trusted device: scanning is faster than manual entry, preserves the exact capitalization, symbols and character order, and avoids mistakes caused by confusing or mistyped characters. It can also transfer a secret without placing it in a synced clipboard.

A QR code is a visual copy of the underlying text, not encryption. Anyone who can see or scan it can recover the password. Only display it around people and devices you trust, avoid saving or sharing screenshots, and close the page when the transfer is complete. For long-term storage and autofill, use a reputable password manager.

What makes a generated password strong?

The generator uses your browser's built-in crypto.getRandomValues() API to choose characters with cryptographically secure randomness, followed by a Fisher-Yates shuffle. Longer passwords drawn from a larger character pool are generally harder to brute-force. The strength meter estimates entropy in bits:

Use a unique password for every account. Avoid reusing generated passwords or adding predictable personal details, and store important credentials in a password manager.