Free Security Tool
Passwords a computer can't guess and you don't have to invent.
Generate long, random passwords and passphrases with a cryptographically secure generator that runs entirely in your browser — with an honest read on how long each one would survive a real attack. Nothing you create here ever leaves your device.
Interactive Generator
Generate a password. See exactly how strong it is.
Password strength is measurable: it is the number of guesses an attacker would need, and it depends on nothing except length and how many characters the generator can choose from. This tool draws every character from your browser's cryptographic random number source, then shows the math — the entropy, the total combinations, and how long the fastest realistic attacks would take to get through them.
Password Generator
Your generated password
Generated on your device. Nothing leaves this page.
Every password is generated on your device with the Web Crypto API — the same cryptographic random source that secures encrypted connections. Nothing is transmitted, logged, or stored, and the generator keeps working offline. ETTE never sees what you create.
The Fundamentals
Three things that actually make a password hard to break.
Length beats cleverness
Every character you add multiplies the attacker's work by the size of the whole character pool. Swapping an S for a $ adds almost nothing; the substitutions people make are the first thing cracking tools try. Twelve extra random characters add more strength than every clever trick combined, which is why the length slider matters more than any other control on this page.
Every account gets its own
Most account takeovers never involve guessing. Attackers take the millions of passwords spilled in one site's breach and replay them everywhere else, a technique called credential stuffing. A password reused on two sites is only as safe as the weaker site's database. Strength cannot fix reuse; only a unique password per account does.
Random is the whole point
Humans are predictable: a capital letter first, a name or a year in the middle, an exclamation point last. Cracking wordlists encode those habits, so a password a person invented is far weaker than its length suggests. This generator draws every character from the browser's cryptographic random source, which has no habits to exploit.
Common Questions
Passwords, explained plainly.
Is it safe to generate a password in a browser?
It is when the generator runs entirely on your device, and this one does. It uses the Web Crypto API built into every modern browser — the same cryptographic random number source that secures encrypted connections. Nothing you generate is transmitted, logged, or stored; the page keeps working with the network cable unplugged. The generators to avoid are the ones that create passwords on a server, because you have no way to know what happens to them there.
How long should a password be?
For anything a password manager fills in for you, 20 random characters is a sensible default — there is no typing cost, so there is no reason to go short. For passwords a human has to type or remember, a passphrase of five or more random words is both stronger and more usable than a shorter string of symbols. Current NIST guidance points the same direction: length and randomness matter far more than forced symbol rules.
Which is better, a random password or a passphrase?
They solve different problems. Random character passwords pack the most strength into the fewest characters, which is ideal for the hundreds of credentials a password manager stores and types for you. Passphrases trade a little length for a lot of memorability, which is ideal for the handful of secrets a human must carry: your computer login, and the master password that unlocks the manager itself.
Do I still need a password manager and MFA?
Yes. A generator solves one problem: passwords too weak to survive a guessing attack. A password manager solves the bigger one — reuse — because a strong password used on two sites falls the moment either site is breached. Multi-factor authentication covers what neither can: a password stolen by phishing or malware. Organizations that deploy all three eliminate the overwhelming majority of account-takeover risk.
Next Step
One strong password is easy. Making every account this strong is the real work.
A generator fixes one password at a time; protecting an organization means a password manager on every device, MFA on every account, and someone watching for the credentials that leak anyway. ETTE deploys and manages exactly that for nonprofits, associations, and small businesses across the DC area.