About this password generator
A strong password is long and random, so it cannot be guessed from a dictionary or from facts about you. This generator uses your browser’s cryptographic random number generator, the same source used for encryption keys, and never sends the result anywhere. It makes three kinds of secret: passwords from the character types you choose, with at least one of each; passphrases of random everyday words, which are easier to remember and type; and numeric PINs. Each result is rated by its entropy, the number of bits an attacker would have to guess.
How to generate a strong password
- Pick a type. Choose Password, Passphrase, or PIN, or press a preset such as Strong password.
- Adjust the settings. For a password, drag Length and tick the character types; for a passphrase, choose the number of words and the separator; for a PIN, set its length.
- Press Generate passwords. Up to 10 results appear, each with a strength bar, its entropy, and an estimated time to crack.
- Copy and save it. Press Copy next to the one you want and store it in a password manager. Press the button again for new ones.
Frequently asked questions
How long should a password be?
Use at least 12 characters for everyday accounts and 16 or more for email, banking, and your password manager. Every extra character multiplies the number of guesses an attacker needs.
Is a passphrase as strong as a password?
It can be. Five random words from this list give about 48 bits of entropy, and six give about 57, while being much easier to remember. The words must be picked at random, not chosen by you.
How is the time to crack estimated?
It assumes an attacker who has stolen a password hash and tries one trillion guesses per second, finding the password after half of all possibilities. Slow hashes such as bcrypt make real attacks far slower.
Why avoid look-alike characters?
Characters such as l, I, and 1 or O and 0 are easy to mix up when you read a password aloud or type it from a screen. Removing them shortens the pool slightly but prevents typing mistakes.
Why does every password contain each type I ticked?
Many sites reject a password unless it has an uppercase letter, a digit, and a symbol. The generator places at least one character from every ticked type and then shuffles the result, so no type sits in a fixed position.