Password Generator
Create strong random passwords or easy-to-type passphrases, and see exactly how strong each one is.
Made on your device with your browser's cryptographic random number generator. Passwords are never sent, saved or logged.
Average time to guess it offline at 10 billion tries a second: about 10¹³ years.
Related Developer Tools
A strong password is one an attacker cannot guess, and the only reliable way to get one is to let a computer pick it at random: people choosing "random" passwords fall into patterns that cracking tools try first. This generator picks every character, or every word of a passphrase, with your browser's secure random number generator, and shows how strong the result is in bits rather than with a vague meter.
How Strong Is Each Setting?
| Setting | Entropy | Average time to guess offline* |
|---|---|---|
| 8 characters, all types | 51 bits | about 1 day |
| 12 characters, all types | 77 bits | about 320,000 years |
| 16 characters, all types | 104 bits | about 1013 years |
| 16 lowercase letters | 75 bits | about 70,000 years |
| 4-word passphrase | 52 bits | about 2 days |
| 6-word passphrase | 78 bits | about 350,000 years |
* At 10 billion guesses a second against fast, unsalted hashes. "All types" means upper and lower case letters, digits and the 28 symbols listed below, with each type used at least once.
Good Password Habits
- Use a different password on every site. When one site is breached, attackers try the same email and password everywhere else. A password manager makes unique passwords practical.
- Memorise only a few. Your password manager's master password and your device login are the ones worth a long passphrase you can type; let the manager store the rest.
- Turn on two-factor authentication for email, banking and your password manager. A stolen password alone is then not enough.
- Do not reuse a generated password after sharing it in chat or email; generate a new one for the account instead.
Related Tools
Generate random IDs with the UUID generator, compute SHA-256 and other checksums with the hash generator, or inspect a login token with the JWT decoder.
Frequently Asked Questions
Is this password generator safe to use?
Yes. Passwords are made on your device with crypto.getRandomValues, the browser's cryptographically secure random number generator, which is designed for keys and passwords, unlike Math.random. They are not sent over the network, saved or logged; reloading the page loses them, so copy each one into your password manager as you create it.
How long should a password be?
For a password a password manager stores for you, 16 or more random characters is a good default. NIST's digital identity guidelines (SP 800-63B-4) require sites to accept passwords of at least 15 characters when the password is the only sign-in factor, and at least 8 when it is combined with another factor such as an authenticator app. Length adds more strength than extra character types: 16 lowercase letters (75 bits) beat 10 characters drawn from all four types (64 bits).
What is a passphrase, and is it as strong?
A passphrase is several random words, such as plaza-unmasked-shrapnel-crib-stoplight-cubical. Each word picked from the 7,776-word EFF list adds about 12.9 bits, so 6 words give about 77.5 bits, as strong as a random 12-character password with all character types and far easier to type and remember. Use passphrases for the few passwords you must type by hand, such as your password manager's master password or your computer login.
What do the bits of entropy mean?
Entropy counts how many passwords these settings could produce: n bits means 2^n equally likely possibilities. Each extra bit doubles the guessing work. The guessing time shown assumes an attacker who has stolen a database of fast, unsalted hashes and tries 10 billion guesses a second; sites that store passwords properly (bcrypt, scrypt or Argon2) slow that by thousands of times, and online login limits slow it far more.
Why use every selected type?
Many sites reject a password without, for example, a digit. With Use every selected type on, each password includes at least one character from every type you selected. The generator draws whole passwords until one qualifies, so every allowed password stays equally likely, and the bits shown already account for the excluded ones.
Which symbols are included?
The symbols are ! # $ % & ( ) * + , - . / : ; < = > ? @ [ ] ^ _ { | } ~. Quotes, the backslash, the backtick and the space are left out because they often break when a password is pasted into a terminal, a config file or a form. Use Leave out these characters if a site rejects some of the others.
Should I change my passwords regularly?
Not on a schedule. Current NIST guidance says sites should not force periodic changes, because people respond with predictable variations. Change a password when there is a reason: the site reports a breach, the password was reused elsewhere, or you suspect someone has seen it.