Password Generator

How to generate a secure password

1. Choose Password or Passphrase at the top.
2. Set the length and the character types, or the number of words.
3. Copy the result into the sign-up form or your password manager. Press Generate for a new one.

Randomness you can trust

A password is only as strong as it is unpredictable. People are bad at inventing random strings: we reuse words, birthdays, keyboard patterns and the same trailing "1!". Attackers know these habits, and their guessing tools try them first. A generator removes the human pattern entirely.

This one uses your browser's cryptographic random number generator (crypto.getRandomValues), the same source browsers use for security features. Characters are picked with rejection sampling, which means every character in the pool is exactly as likely as any other. A shortcut many generators take, taking a random number modulo the pool size, slightly favors some characters; this avoids that. The password is created in the page on your device. It isn't sent over the network, logged or saved, and it's gone when you generate a new one or close the tab.

Password or passphrase?

Passphrases draw words at random from a list of 2,048 common English words (the BIP-39 list), so each word adds exactly 11 bits. Five words give 55 bits, six give 66. The words are easy to type on a phone keyboard and much easier to remember than a jumble of symbols. What makes them strong is that the words are chosen by the computer, not by you: a phrase you pick yourself from a favorite song is far weaker than its length suggests.

Reading the strength meter

The meter measures entropy: how many guesses an attacker would need if they knew exactly how the password was made, which is the honest worst case. Labels go from Weak (under 40 bits) through Fair and Strong to Very strong (80 bits and above). The time estimate assumes an attacker trying 10 billion guesses a second, a realistic figure for a well-equipped offline attack on a stolen database with a fast hash. Sites that store passwords properly slow attackers far more than that, and online login forms far more still, so the real-world margin is usually larger. The estimate only applies to passwords made here: a human-chosen password of the same length can fall in seconds.

Options explained

• Length: 4 to 128 characters. Length adds strength faster than extra symbols do; 16 random characters is a solid default.
• Leave out look-alikes: removes I, l, 1, O, 0 and |, handy when a password will be read aloud or copied from paper.
• Use every selected type: guarantees at least one character of each ticked type, for sites that insist on it.
• How many: make 5 or 10 at once and pick one you like.

Good habits that matter more than any single password

• Use a different password for every account, so one leak doesn't unlock the others.
• Keep them in a password manager instead of a note or spreadsheet.
• Turn on two-step verification wherever it's offered.
• Current NIST guidance favors long passwords and passphrases over forced symbol rules and routine expiry.

Want to check a file you downloaded rather than create a secret? Use the SHA-256 Hash Generator.