Password Generator
Create strong, random passwords or easy-to-type passphrases using your browser’s cryptographic random generator. Pick the length and character types and see how strong each one is. Passwords are never sent or stored.
Choose the options above, then click Generate. Each password uses crypto.getRandomValues, the same cryptographic random source browsers use for encryption keys.
How it works
- Choose a typeA random password for maximum strength in few characters, or a passphrase of random words that is easier to remember and type.
- Set the optionsLength and character types, or number of words and a separator.
- GenerateEach password is built from cryptographically secure random numbers with no bias, and the strength is shown in bits of entropy.
- Save it safelyCopy it straight into your password manager. Nothing is stored on this page.
What makes a password strong
Strength comes from unpredictability, measured in bits of entropy: each extra bit doubles the number of guesses an attacker needs. A random 16-character password using upper and lower case letters, digits and symbols has about 100 bits, far beyond what can be brute-forced. Length matters more than complexity: adding four characters helps more than adding symbols to a short password.
What makes passwords weak in practice is reuse. When one website is breached, attackers try the same email and password everywhere else. Use a different password for every account, keep them in a password manager, and turn on two-factor authentication for email, banking and anything important.
Passphrases
A passphrase such as "velvet-harbor-sneeze-quilt-outcast" is several words picked at random from the Electronic Frontier Foundation's 7,776-word list. Each word adds about 12.9 bits, so five words give about 65 bits and six give about 78, with far less effort to remember or type on a phone than random symbols. The randomness has to come from a computer or dice, not from you: phrases people choose themselves are much easier to guess.
Rules and tips
- If a site rejects symbols, untick them and add length instead.
- "No look-alikes" removes characters such as I, l, 1, O and 0 that are easy to confuse when reading a password aloud or typing it from paper.
- Every password includes at least one character from each type you select.
- For Wi-Fi passwords you share with guests, a passphrase is much easier to type on a TV or phone.
Frequently asked questions
Is it safe to generate passwords on a website?
Here, yes: passwords are generated by your browser with its cryptographic random generator and are never sent, logged or stored. You can even disconnect from the internet after the page loads.
How long should my password be?
At least 16 random characters, or a passphrase of five to six words, for important accounts.
What does "bits of entropy" mean?
How many yes-or-no guesses it would take on average to find the password: 80 bits means about 2 to the power of 80 possibilities.
Should I change my passwords regularly?
Current guidance from NIST says no, unless there is a sign of compromise. A long, unique password plus two-factor authentication is better than frequent changes.