Scan & Generate
Free Password Generator
Generate strong random passwords instantly. Choose your length and character types, then copy or encode as a QR code.
Click Generate What Makes a Strong Password?
Password strength is determined by two key factors: length and character set size. The number of possible combinations is character_set_sizelength.
| Length | Lowercase only | Upper + Lower + Numbers | All characters |
|---|---|---|---|
| 8 | 208 billion | 218 trillion | 6.6 quadrillion |
| 12 | 95 quadrillion | 3.2 × 10²¹ | 4.7 × 10²³ |
| 16 | 4.4 × 10²² | 4.7 × 10²⁸ | 3.4 × 10³¹ |
| 20+ | Practically uncrackable with current technology | ||
Password Best Practices
- Use at least 16 characters for important accounts
- Never reuse passwords across sites
- Use a password manager (Bitwarden, 1Password, iCloud Keychain)
- Enable two-factor authentication (2FA) wherever possible
- For WiFi passwords, 20+ characters is recommended — and creating a QR code means guests never need to type it
Frequently Asked Questions
How long should a strong password be?
Length matters more than complexity. For most accounts 16 characters drawn from a mixed character set is comfortably strong; for anything protecting money, email or infrastructure, prefer 20 or more. A long passphrase of unrelated words beats a short string of substituted symbols.
Are the passwords generated here random?
They are generated in your browser using the Web Crypto API, which draws on the operating system's cryptographically secure random source — not JavaScript's Math.random(), which is predictable and unsuitable for secrets.
Is it safe to generate a password on a website?
It depends entirely on whether the page sends anything to a server. This one does not: generation happens in your browser, nothing is transmitted, and nothing is logged. You can confirm that by opening your browser's network tab, or by disconnecting from the internet — the tool keeps working.
Should I use symbols in my password?
Include them where the site allows it, but do not rely on them. Adding four characters of length increases the search space far more than swapping an 'a' for an '@'. Some systems also reject or silently truncate certain symbols, which is a common cause of a password that mysteriously stops working.
What is the difference between a password and a passphrase?
A passphrase is several unrelated words separated by spaces or hyphens. It is easier to type and remember, and because it is long it can be just as hard to guess. The important thing is that the words are chosen at random, not picked by you — self-chosen words cluster around predictable themes.
Do I need a different password for every account?
Yes, and this is the single highest-value security habit there is. Credential-stuffing attacks take passwords leaked from one breached site and try them everywhere else. A unique password per account limits any breach to the one account. A password manager makes this practical.
How often should I change my password?
Modern guidance from bodies including NIST is to stop forcing routine expiry. Scheduled changes push people toward small predictable variations. Change a password when you have reason to — a breach notification, a shared device, or any suspicion of exposure.
Can I turn a password into a QR code?
Yes. It is most useful for Wi-Fi: a Wi-Fi QR code lets a guest join by pointing a camera at it instead of typing a long key. Treat the printed code as you would the password itself — anyone who can see it can join.
Encode Passwords as QR Codes
Use the Scan & Generate app to turn your WiFi password into a scannable QR code — guests connect with one tap, no typing needed.