Developer tool
Password Generator
Generate strong random passwords and passphrases in your browser, with entropy, crack-time estimates, custom symbols and bulk generation.
Free, no sign-up. Runs in your browser; nothing is uploaded.
Generated password
Generating...
Very strong strength. At 10 billion guesses per second, a brute-force attack would take on average about 25 trillion years.
Options
Edit to customise the symbol set.
How to use the password generator
How to generate a password you can trust
Pick the Password type for a random string, or Passphrase for several random words. Every change you make regenerates the result instantly, and the strength meter below it tells you how hard the result is to guess.
Choosing a length
Length matters more than symbols. As a rule of thumb:
- 12 characters is the minimum for low-value accounts.
- 16 characters with mixed sets is a good default for most logins.
- 24 or more for banking, email, and your password manager's master secret.
Each extra character multiplies the number of possibilities by the size of the character pool, so adding four characters helps far more than swapping one letter for a symbol.
Character sets and sites with rules
Some sites reject certain symbols or demand at least one digit. Use the require at least one of each selected set option for sites with composition rules, and edit the symbol box to remove characters a site refuses. If you must read the password aloud or type it from paper, exclude the look-alike characters 0 O 1 l I.
Reading the strength meter
Entropy is shown in bits and mapped to a label:
- Weak under 40 bits.
- Fair from 40 to 59 bits.
- Good from 60 to 79 bits.
- Strong from 80 to 99 bits.
- Very strong at 100 bits and above.
The crack-time line assumes ten billion guesses per second, which is realistic for a stolen database protected by a fast hash. It is meant for comparing options, not as a promise.
Passphrases
A passphrase uses words drawn at random from a list of over a thousand common words. Five words give roughly 50 bits, seven give about 70. Choose a separator you can type easily and add the capital letter or number option only when a site demands it, since those add little strength on their own. Never replace a word with one you like better: that makes it less random.
Good habits
- Use a different password for every account and store them in a password manager.
- Turn on two-factor authentication wherever it is offered.
- Generate a new password rather than modifying an old one.
- Use the Hide button when someone might be looking at your screen.
Frequently asked questions
Is the password really random?
Yes. Characters are chosen with the browser's cryptographic random number generator (crypto.getRandomValues), and an unbiased rejection-sampling step makes sure every character is equally likely. Math.random is never used.
Is anything stored or sent?
No. Passwords are generated on your device and never leave the page. Nothing is logged or saved, and reloading the page discards them.
What does entropy in bits mean?
Entropy measures how many guesses an attacker needs in the worst case: a password with 60 bits has 2^60 equally likely possibilities. Each extra bit doubles the work. It is calculated as length times log2 of the number of possible characters.
Passphrase or password, which should I use?
Use a random password for accounts stored in a password manager. Use a passphrase of 5 or more words for things you must type or remember, such as a device login or the manager's master password.
How accurate is the crack-time estimate?
It assumes an offline attack at 10 billion guesses per second against a fast, unsalted hash and that the attacker knows your settings. Real sites use slow hashes, so reality is usually better, but the figure is a useful comparison.
Why exclude look-alike characters?
Characters such as 0, O, 1, l and I are easy to confuse when you read a password aloud or copy it by hand. Excluding them costs a few bits of entropy, which you can win back with a longer length.