Generate a strong, random password
Create a random password for your accounts, email, server or database in one click. No sign-up, no ads.
The time is an average estimate for an attack making 1 trillion guesses per second.
A PIN is short and digits only. Use it only where failed attempts are limited (phone, card, door).
How it works
Generated on your device
The password is created in your browser and is not sent to our server. Once loaded, the page works without an internet connection.
Cryptographic randomness
Characters are chosen with the browser's secure random number generator (crypto.getRandomValues), each with equal probability.
Passwords are not stored
Generated passwords stay on the page and are gone when you close it. Your browser remembers only the length and options.
From the terminal
Working on the command line? Get a password straight in your terminal.
# 16 characters curl https://sifreuret.com # choose a length (4-128) curl https://sifreuret.com/32 # email / panel curl https://sifreuret.com/eposta # database / terminal curl https://sifreuret.com/komut # PIN curl https://sifreuret.com/pin # several at once (1-50) curl "https://sifreuret.com/32?adet=5"
In terminal mode the password is generated on our server, not in your browser; it is delivered over HTTPS and not stored. If you want it never to touch a server, use this page.
Tips for safe passwords
- Use a different password for each account. A password leaked from one site opens every other account that uses it.
- Length matters most. Each extra character makes guessing exponentially harder.
- Use a password manager. You do not have to memorise long random passwords; one master password is enough.
- Turn on two-factor authentication. Even if your password is stolen, your account is harder to get into.
- Do not send passwords as plain text. Passwords left in email and chat history stay readable for a long time.
FAQ
Can you see the passwords I generate on this page?
No. Passwords on this page are generated in your browser and are not sent to our server. When you open the page, the web server keeps an access log as on any site (IP address, date, requested address); these logs contain no passwords. See the privacy policy for details.
How can I verify this?
Open the network tab in your browser's developer tools and generate a new password: you will see that no request is made. The page's security policy (Content-Security-Policy, connect-src none) also stops scripts from sending data in the background.
Is terminal mode different from this page?
Yes. A password you get with curl is generated on our server, not in your browser, and is delivered over HTTPS. It is not stored; the access log shows only the IP address and request path (such as /32). If you want the password never to touch a server, use this page or run openssl rand -base64 24 on your own computer.
How long should a password be?
At least 16 characters is enough for most accounts. A random 16-character password with letters, digits and symbols is not practical to find by guessing. If you keep it in a password manager, you can choose a longer one.
Which preset should I choose?
General suits most accounts; it uses common symbols and starts with a letter. Email / panel also leaves out symbols that cause problems on some systems. Database / terminal uses characters that need no escaping on the command line or in connection URLs. PIN is digits only.
Does leaving out confusing characters weaken a password?
Only slightly. Without 0, O, o, 1, l, I, i and | the password is drawn from a slightly smaller set; adding a few characters more than makes up for it. In return, mistakes are less likely when you read or type it.