Password Generator

This password generator creates strong random passwords and memorable passphrases on your device. Choose a length from 4 to 128 characters and the character types you want, and a new password appears instantly. A strength meter shows its entropy in bits and roughly how long it would take to guess.

It is for anyone setting up a new account, changing an old password, or creating credentials for a team or a test system. If a site has strict rules, you can choose exactly which symbols to use, leave out characters such as { } that some sites reject, and require at least one character of every selected type.

Every character is picked with your browser's cryptographic random number generator. Passwords are never sent, stored or logged, and they are gone as soon as you close the page.

A password's strength depends on how many passwords an attacker would have to try before finding yours. Entropy measures that number in bits. Each extra bit doubles the number of guesses needed, so 60 bits is about a thousand times harder to guess than 50.

For a random password, entropy is the length multiplied by log2 of the number of possible characters. Lowercase letters alone give about 4.7 bits per character. All four types together, letters, digits and 27 symbols, give about 6.5 bits per character. A random 16-character password using all four types has about 103 bits.

Length adds strength faster than extra character types do. Going from 12 to 16 characters adds about 26 bits. Adding symbols to a 12-character letters-and-digits password adds only about 6.

• Under 40 bits: weak. Can be cracked quickly if a site's password database leaks.
• 40 to 59 bits: fair. Fine for low-value accounts with rate-limited logins.
• 60 to 79 bits: strong. Good for most accounts.
• 80 bits or more: very strong. Recommended for email, banking and your password manager.

A passphrase is a string of random words, such as Ripple-Canyon-Lantern-Otter7-Maple-Quartz. Each word from this tool's list adds about 10 bits, so six words plus a number give about 66 bits, and eight words about 80.

Passphrases are easier to remember and to type on a phone, but they are longer than a random password of the same strength. Use them for the few passwords you have to type from memory, and let a password manager store random passwords for everything else.

The words must be chosen randomly for this math to hold. A phrase you make up yourself, like a song lyric, is far weaker because attackers try common phrases first.

The estimate assumes an attacker has stolen a password database and can test 10 billion guesses per second offline, which is realistic for a fast hash on modern graphics cards. On average they find a password after searching half of all possibilities.

Real attacks on a website's login page are millions of times slower, and sites that store passwords with slow hashes such as bcrypt or Argon2 slow attackers down further. The estimate is a cautious worst case, not a promise.