About the Password Generator
A strong password is long, random and used for one account only. People are bad at inventing randomness, which is why passwords like Summer2024! keep showing up in data breaches. The Password Generator does the random part for you, using the same cryptographic random number generator your browser uses for encryption.
Choose a password of 4 to 128 characters from uppercase letters, lowercase letters, digits and symbols, or a passphrase of 3 to 12 random words that is easier to type and remember. You can avoid characters that look alike, make sure every character type appears, and generate up to 50 at once.
Each result comes with its strength in bits and an estimate of how long a fast offline attack would need. A separate checker gives a rough estimate for any password you type, with tips on what makes it weak. Nothing is sent anywhere: passwords are created and checked in your browser and disappear when you close the page.
How to use it
- Choose Password or PassphrasePassword gives random characters. Passphrase gives random words joined by a separator, which are easier to type on a phone or read aloud.
- Set the length and charactersFor passwords, drag the length slider (4 to 128) and pick A-Z, a-z, 0-9 and symbols. For passphrases, choose 3 to 12 words, a separator, capitals and an optional number.
- Add rules if a site needs themAvoid look-alikes drops I, l, 1, O, 0 and o. Use every selected type guarantees at least one of each. No character twice in a row prevents pairs like "aa".
- Check the strengthThe meter shows the strength of the settings in bits, with the time a fast offline attack would need to try half of all possibilities.
- Copy and save itCopy one result, copy all of them, or download passwords.txt. Store the password in a password manager right away.
Key features
Cryptographically secure
Every character and word is picked with crypto.getRandomValues and rejection sampling, so each choice is equally likely.
Passwords up to 128 characters
Mix uppercase, lowercase, digits and 25 symbols: !@#$%^&*()-_=+[]{};:,.?/~
Passphrases from 2,048 words
Words come from the BIP39 English list, which uses common, distinct words with no two sharing the same first four letters.
Rules for picky sites
Avoid look-alikes, require every selected character type, or forbid the same character twice in a row.
Strength checker
Type any password for a rough estimate. It spots common passwords, dictionary words, sequences, repeated characters and years.
Private by design
Nothing is uploaded, logged or stored. Generated and checked passwords exist only on this page.
Examples
How strong are the settings?
The strength in bits is the length multiplied by log2 of the number of possible characters. The meter rates under 40 bits as Weak, under 60 as Fair, under 80 as Strong and 80 or more as Very strong:
| Settings | Bits | Rating |
|---|---|---|
| 8 characters, a-z only | 38 | Weak |
| 8 characters, all four types | 52 | Fair |
| 12 characters, letters and digits | 71 | Strong |
| 12 characters, all four types | 77 | Strong |
| 16 characters, all four types | 103 | Very strong |
| 20 characters, all four types (default) | 129 | Very strong |
Attack times assume 10 billion guesses per second, a fast offline attack on a leaked password database. At that speed, 38 bits fall in about 14 seconds, 52 bits take about 3 days, 71 bits about 37 centuries, and 103 bits longer than the age of the universe.
Passphrases
Each word adds 11 bits, because it is one of 2,048 choices. The default "Add a number" puts 0 to 99 after one random word, which adds about 9 bits:
| Words | Without number | With number |
|---|---|---|
| 4 | 44 bits, Fair | 53 bits, Fair |
| 5 (default) | 55 bits, Fair | 64 bits, Strong |
| 6 | 66 bits, Strong | 75 bits, Strong |
| 8 | 88 bits, Very strong | 98 bits, Very strong |
A default passphrase looks like Easy-Lift-Goat25-Fall-Option. Capital letters do not add strength here, since every word is capitalized the same way.
Avoiding look-alikes
With Avoid look-alikes on, 6 characters are removed (I, l, 1, O, 0 and o), so the pool shrinks from 87 to 81 characters. A 12-character password then has 76 bits instead of 77, a small price for a password you have to read off a screen and type on another device.
Checking passwords you already use
| Password | Estimate | Why |
|---|---|---|
| P@ssw0rd | Weak, 0 bits | One of the most common passwords |
| Summer2024! | Weak, 25 bits | A dictionary word and a year |
| M0nkey!Dragon | Weak, 29 bits | Two dictionary words, one with a 0 for an o |
| kT9#vQ2m!xR7pL4w | Very strong, 105 bits | 16 random characters of all types |
Tips
- Use a different password for every account. If one site is breached, attackers try the same email and password everywhere else.
- Let a password manager store your passwords. Then length costs you nothing, and 20 random characters are as easy to use as 8.
- Use a passphrase for the few passwords you must type from memory, such as your password manager, your computer login or your phone.
- If a site limits length or symbols, use the longest length it accepts and turn off only the character types it rejects.
- Turn on two-factor authentication wherever it is offered. Even a perfect password can be phished; a second factor stops most of those attacks.
Common mistakes and limits
- Making a random password "memorable"Changing a generated password into something meaningful, or reusing it with a different number at the end, removes most of its strength.
- Trusting the checker for word-based passwordsThe checker knows the 2,048 words of the passphrase list and the most common passwords, not every word or name. A phrase of words outside that list can still be rated higher than it deserves.
- Choosing passphrase words yourselfA passphrase is only strong when the computer picks the words. Song lyrics, quotes and favorite things are in attackers' dictionaries.
- Thinking symbols matter more than lengthAdding symbols to an 8-character password raises it from 38 to 52 bits. Making it 16 lowercase letters gives 75 bits.
- Saving passwords in plain textThe downloaded passwords.txt is not encrypted. Move the passwords into a password manager and delete the file.
