Free tool · No upload · No sign-up

Password Generator

Random passwords, passphrases, PINs and pronounceable passwords from your browser's cryptographic random number generator — with exact entropy maths, realistic crack-time estimates, bulk generation and presets for network engineers (WPA2/WPA3 PSK, RADIUS & TACACS+ secrets, SNMPv3, BGP MD5, IPsec). Nothing you generate or type is sent anywhere or stored.

Feedback
Mode
Presets
General Network engineering

Network presets use CLI-safe characters — nothing that breaks Cisco/Juniper CLI parsing, quoting or copy-paste (? " ' ` \ | < > & / $ and spaces are excluded).

Random password

Separators from grouping are fixed — they add length but no entropy, and the maths here reflects that.

Passphrase

7,776-word list (like EFF dice-ware): each word adds 12.9 bits however common the words look — the strength is in the count, not the obscurity.

Pronounceable

Easier to read out over the phone or type on a TV remote. Entropy is counted from the actual random choices made — typically ~3.5 bits per character, so go long.

PIN
Check a password

Analysed entirely in this page — it is never sent anywhere, stored, or added to the history below. The estimate assumes the attacker knows your tricks (dictionary words, l33t swaps, years, keyboard runs).

Bulk

Handy for provisioning: one per line, copy or download as .txt.

Generated password
Choose your options — a password appears here instantly.
Strength
– bits–
Attack scenarioGuess rateAverage time to crack

Average = half the keyspace. Rates are order-of-magnitude: a throttled web login, an unthrottled API/RDP spray, an offline attack on a slow hash (bcrypt/argon2), and an offline rig against a fast hash (MD5/NTLM). If the hash leaks and it's MD5, only the last row matters.

How the randomness works.
  • Every character and word is drawn with crypto.getRandomValues() — the same CSPRNG your browser uses for TLS — never Math.random().
  • Rejection sampling removes modulo bias, and "at least one of each set" is enforced by regenerating rather than forcing positions, so every allowed password is exactly equally likely. The entropy shown accounts for that constraint (inclusion–exclusion), not just length × log₂(alphabet).
  • CLI-safe mode drops ? " ' ` \ | < > & / $ and spaces: ? triggers context help on Cisco CLI, quotes and backslashes break quoting on Juniper/parsers, and $ gets interpolated by shells and some NMS templates.
  • Secrets for RADIUS/TACACS+ are shared keys — rotate them per device pair where you can, and remember older IOS truncates long TACACS+ keys silently.
  • Prefer length over complexity: a 5-word passphrase (~64 bits) beats Tr0ub4dor&3-style substitutions, and it survives being typed on a phone.

Built by IPWOX — independent network & security consultancy. 100% client-side: this page makes no network requests with your data, and generated passwords never leave your browser. More free tools.

Password Generator v1.0.1 · © 2026 IPWOX Limited — free to use, not licensed for republication

Related IPWOX tools: Config Sanitizer · Cisco 802.1X NAC Config Generator · FortiGate VPN Config Generator — all free, all run in your browser. See all tools.