Loading tools
Loading tools
Loading tool
4 modes, live entropy + crack-time, bulk + CSV, HIBP breach check.
0.0 bits of entropy from a pool of 0 possibilities. NIST recommends 80+ bits for accounts you care about; 128+ for the paranoid.
We SHA-1 the password locally, send only the first 5 hex chars to api.pwnedpasswords.com, and check the response locally. The password and full hash never leave your browser.
Random, Diceware, pronounceable, or pattern-based. Live entropy + crack-time meter. Bulk generate up to 100 with CSV export. Optional Have I Been Pwned check via k-anonymity (your password never leaves the browser). 100% client-side cryptographic randomness.
Random characters, Diceware passphrase, pronounceable, or pattern-based template. Each suits a different use case.
Length, character classes, exclude similar / ambiguous chars, ensure-one-of-each. Live entropy meter shows the bits you're building.
One click to copy. Or set bulk to 100 and download a CSV. Cryptographic-grade randomness, never Math.random.
Random char-class for site logins, Diceware passphrase for memorability, pronounceable for verbal handoff, pattern-based for sites with strict format rules. Most generators offer only random.
Bits of entropy displayed as you type. Crack time shown at 4 attack tiers: online throttled, online unthrottled, offline slow hash (PBKDF2), offline fast hash (10B/sec GPU). zxcvbn-compatible scoring.
Generate 100 unique passwords at once. Copy individually or download as CSV. Useful for seeding test accounts, recovery codes, or batch-creating new logins.
Optional k-anonymity check: we SHA-1 your password locally, send only the first 5 hex chars to HIBP, check the response locally. The password and full hash NEVER leave your browser.
Uses crypto.getRandomValues() with rejection sampling to avoid modulo bias. Math.random() is not cryptographically secure; many free generators get this wrong. Ours produces output that's safe for security tokens.
Many sites require 'at least one upper, lower, digit, symbol'. Our 'ensure each class' option guarantees the output passes those checks without sacrificing randomness.
Drop Il10O for handwritten or read-aloud passwords. Drop {}[]() for systems that mangle them. Toggle independently.
Generation, entropy analysis, crack-time computation, and the bulk export all run locally. The HIBP check is the only network request and uses k-anonymity. Open the network tab to verify.
LastPass, 1Password, Norton, Bitwarden , most free generators are loss-leaders for paid managers. We don't sell anything. The tool stands alone, free, with all features included.
Many free generators use Math.random(), which is not secure. Skilled attackers can recover the seed and predict future outputs. We use crypto.getRandomValues() exclusively, the same primitive Web Crypto and TLS use.
Random for password manager storage. Diceware for what you'll type. Pronounceable for what you'll say over the phone. Pattern for sites with format quirks. Pick the right tool for the job.
No competitor offers bulk generation AND breach checking AND multi-mode AND offline-capable in one tool. We do, free.
| Feature | Molixa Password Generator | LastPass | Bitwarden |
|---|---|---|---|
| Free, no signup | Yes | Yes | Yes |
| 4 generation modes | Random, Diceware, Pronounceable, Pattern | Random + simple passphrase | Random + Diceware |
| Bulk generate | Up to 100 with CSV export | One at a time | One at a time |
| Live entropy meter | Bits + 4 attack tiers | Basic strength bar | Basic strength bar |
| HIBP breach check | Yes, k-anonymity | In paid app | In paid app |
| Pattern-based templates | Yes | No | No |
| Cryptographic random | crypto.getRandomValues + reject sampling | Yes | Yes |
| Standalone (no manager) | Yes | Pushes manager signup | Pushes manager signup |
Pick Random, length 16, all 4 classes on, copy. Paste into the signup form. Save in your password manager. Done in 5 seconds.
Pick Diceware, 6 words, capitalize on, separator '-'. Result: 'Battery-Horse-Staple-Apple-River-Sunset'. ~70 bits, easy to type, no manager could ever lose it for you.
Pick Pronounceable. Length 14. Result: 'pulokirakapule'. Easier to read aloud than 'X#k$2vQ!9j@n'.
Site says 'exactly 12 chars, 2 digits, 1 symbol, no ambiguous'? Pick Pattern, template 'aaaaaaaa-99?'. Result fits the format on the first try.
Set bulk to 50, hit generate, download CSV. Each row is a fresh, unique, strong password. No more 'Password1', 'Password2' for QA accounts.
Type or paste a password (or copy a generated one), click 'Check this password'. The k-anonymity protocol checks Have I Been Pwned without sending your password anywhere.
Generation happens locally using crypto.getRandomValues, the cryptographically secure PRNG built into every modern browser. Entropy analysis happens locally. Crack-time computation happens locally. Bulk export downloads from your tab to your disk without going through any server.
The optional Have I Been Pwned breach check uses k-anonymity. We SHA-1 your password in the browser, send only the first 5 hex characters of the resulting 40-character hash to api.pwnedpasswords.com, and check locally whether your specific 35-character suffix is in their response. The remote service never sees the password, never sees the full hash, and could not reconstruct either from the prefix it receives. This protocol is well-documented and audited; Troy Hunt (HIBP's author) has written extensively about the privacy guarantee.
Cryptographic randomness, k-anonymity breach check, no upsell. Generate, save in your manager, move on.
Bulk generate API tokens, recovery codes, test passwords. Pattern mode for systems with strict format rules. CSV export for piping into your provisioning scripts.
No paid tier, no geographic gating, no signup required. Works the same in every country. Output is plain text , copy and use anywhere.
Bulk export 100 passwords to seed test accounts. CSV format drops into spreadsheets and provisioning scripts. Every password is independently random.
Free. No signup. No upsell into a paid password manager. Just the strongest passwords you can paste in.
Start generatingThe Password Generator page is built, reviewed, and maintained by the Molixa team. We use the tool we ship and update the docs when the behavior changes.