Utility Generators
Password Generator
Generate long, random passwords with length and character-set controls. Runs entirely in your browser.
Hit Generate to forge a result.
About this password generator
Need a password that is actually hard to guess—not your pet’s name with a 1 at the end? This generator builds a random character string from the sets you enable: lowercase, uppercase, numbers, and symbols. Default length is 20 characters, which sits comfortably above common “make it long” advice from security agencies.
Everything runs locally in your browser. Rollforge does not upload the password as part of generation. Copy it into a password manager, then clear the results if you are on a shared screen.
Prefer memorable word phrases instead? Use the passphrase generator. Prefer this tool when a site demands mixed character types or you want a high-entropy secret you will never try to memorize.
How this generator builds a password
Choose a length (default 20) and toggle character sets: lowercase (abc), uppercase (ABC), numbers (123), and randomized symbols (!#$). Each click draws from the selected sets using your browser’s cryptographic random number generator when available, and includes at least one character from every enabled set when length allows. Nothing is uploaded to Rollforge as part of generation—copy the result into a password manager.
FAQ
Is my generated password sent to a server?
No. Generation runs in your browser. Copy it into a password manager; do not leave it visible on a shared or recorded screen.
Why default to 20 characters?
Length is the main lever against guessing. CISA recommends at least 16 characters; NIST’s single-factor minimum for verifiers is 15. Twenty gives comfortable headroom while remaining practical for managers and most signup forms (many should allow at least 64 per NIST).
Do I need symbols if NIST says not to require complexity rules?
NIST tells *websites and verifiers* not to force composition rules (like “must mix character types”) on users choosing their own passwords—length, blocklists, and rate limiting matter more. This generator still offers character sets because many legacy sites require them, and CISA still lists mixed-case letters, numbers, and symbols as one valid way to make a password random. Use what the account requires; prefer length either way.
Password generator vs passphrase generator—which should I use?
Use this page for high-entropy random strings (especially when a form demands symbols or a fixed character mix). Use the passphrase generator when you need something memorable to type (for example, a password-manager master phrase). CISA accepts both styles when they are long, random, and unique.
Is browser randomness good enough?
This tool prefers the Web Crypto API (cryptographically strong) when the browser provides it. That is appropriate for everyday account passwords. For specialized key-generation or compliance environments, use a dedicated secrets tool or hardware module your policy specifies.
Should I change this password every few months?
Not on a calendar by default. NIST SP 800-63B-4 says verifiers shall not require periodic password changes; change it if there is evidence of compromise, you reused it somewhere, or you shared it accidentally.
What makes a strong password
- Make it long. CISA recommends at least 16 characters (longer is stronger). NIST SP 800-63B-4 requires verifiers to enforce a minimum of 15 characters when a password is the only authenticator (8 if it is only one factor among multi-factor authentication), and recommends allowing up to at least 64 characters.
- Make it random. CISA’s guidance: use a random mix of upper- and lowercase letters, numbers, and symbols—or a passphrase of several unrelated words. Avoid names, birthdays, pet names, and keyboard walks like “12345”.
- Make it unique. Use a different strong password for every account. Reuse is how one breach cascades into email, banking, and social takeovers (CISA).
- Store it in a password manager. Both CISA and NIST emphasize password managers: NIST tells verifiers they SHALL allow managers and paste/autofill; CISA recommends managers so you only memorize one strong master secret (ideally a long passphrase).
- Turn on MFA. Pair every important account with multifactor authentication. A stolen password is far less useful when a second factor is required (CISA).
- Skip periodic “change every 90 days” theater unless there is evidence of compromise. NIST SP 800-63B-4 says verifiers SHALL NOT require subscribers to change passwords periodically, but SHALL force a change if the authenticator is known to be compromised.
- Avoid blocked weak choices. NIST requires services to screen new passwords against a blocklist of commonly used, expected, or compromised values—and not to rely on arbitrary “must include a symbol” rules alone. Generators help with randomness; sites should still reject known-bad secrets.
- Sources: CISA “Use Strong Passwords” (cisa.gov/secure-our-world/use-strong-passwords) and NIST SP 800-63B-4 Digital Identity Guidelines (July 2025).