Password Generator
Strong random passwords and memorable passphrases, created on your device.
- Free
- No sign-up
- Runs in your browser
Your new password
16 charactersVery strong· 104 bits of entropy
About 24.6 trillion years to crack on average. Out of reach of any realistic guessing attack.
Crack time assumes the attacker knows exactly how this password was made and tries 10 billion guesses a second (a multi-GPU rig against a fast, unsalted hash), finding it halfway through on average. Sites that store passwords with slow hashes like bcrypt make this thousands of times harder.
Recent in this session
Passwords you copy or replace show up here, so you can get back one you skipped. The list is kept only in this tab’s memory.
How this password generator works
Each character is picked at random from the types you switch on, using your browser’s cryptographically secure random number generator. Picks are unbiased: a random number that would favour some characters over others is thrown away and drawn again, so every character is exactly as likely as any other. Nothing leaves your device.
Strength is measured in bits of entropy — how many guesses an attacker who knows your settings would need. With all four types there are 90 possible characters, and each adds log₂(90) ≈ 6.49 bits, so a 16-character password has about 104 bits (103.6 once you require one of each type). At 10 billion guesses a second, finding it would take around 25 trillion years on average. An 8-character lowercase password has only 37.6 bits and falls in about 10 seconds.
Password or passphrase?
A passphrase strings together random words, like Nail-Slate-Tweak-Buzz-Herbs1-Speak. It is easier to type and remember, which makes it a good choice for the few passwords you must type by hand — your computer login, phone or password manager. Six words from this list give about 62 bits (68 with a number added), about as strong as a 10-character random password. For everything else, let a password manager store a long random password.
How long should a password be?
Aim for at least 14–16 random characters, or 6 random words. Length beats complexity: every extra character multiplies the work for an attacker by 90, while swapping letters for symbols in a real word (P@ssw0rd) barely helps, because cracking tools try those swaps first. Use a different password for every site, so one leak can’t unlock the rest.
Frequently asked questions
- Is it safe to use an online password generator?
- This one runs entirely in your browser: the password is made with crypto.getRandomValues on your device and is never sent, logged or saved. You can disconnect from the internet after the page loads and it keeps working.
- Which symbols are used?
- These 28: ! # $ % & ( ) * + , - . / : ; < = > ? @ [ ] ^ _ { | } ~. Quotes, backslash and backtick are left out because they often break in forms, scripts and spreadsheets.
- What does “Use every type” do?
- It makes sure each selected type appears at least once, for sites that demand a digit or symbol. The generator redraws the whole password until it qualifies, so it stays fully random; the entropy shown accounts for the few passwords this rules out.
- Where does the passphrase word list come from?
- It is based on the EFF Short Wordlist, designed by the Electronic Frontier Foundation for memorable passphrases, with a few names and brands removed — 1,247 words of 3 to 5 letters.