Strong Password Generator
Create a strong random password, an easy-to-remember passphrase or a PIN in one click. Choose the length and characters, avoid look-alike letters and see how long the result would take to crack. Passwords are made on your device with the browser’s secure random generator and are never sent or stored.
- Cryptographically secure
- Never sent or saved
- Passphrases & PINs
- Strength meter
–
Options
Words come from the EFF long word list (7,776 common English words, CC BY 3.0).
PINs are only safe where the number of tries is limited, like a phone lock screen or a bank card.
Need several?
Generated on your device with the browser’s secure random generator (Web Crypto). Nothing is sent or saved.
How to use
- Choose Password, Passphrase or PIN.
- Set the length and the characters to include. 16 characters with all types is a strong default.
- Check the strength bar. Aim for Strong or Very strong.
- Press Copy and paste the password into the sign-up form, then save it in your password manager.
- Press ↻ New for another one, or Generate list to make several at once.
Frequently asked questions
Is this password generator safe?
Yes. Passwords are created in your browser with crypto.getRandomValues, the same secure random source used for encryption keys. They are never sent over the internet, logged or saved by us.
How long should my password be?
Use at least 12 characters, and 16 or more for email, banking and other important accounts. Length matters more than complexity: every extra character multiplies the number of guesses needed.
What is a passphrase?
A passphrase is several random words joined together, such as Velvet-Canyon-Pickle-Orbit-Tundra. Five random words from a 7,776-word list give about 65 bits of entropy, which is strong and much easier to type and remember than random symbols.
What does “bits of entropy” mean?
It measures how unpredictable a password is. Each extra bit doubles the guesses an attacker needs. Under 40 bits is weak, 60 bits is strong for most accounts and 80+ bits is very strong.
Why avoid look-alike characters?
Characters like I, l, 1, O and 0 are easy to confuse when you read a password aloud or type it from paper. Leaving them out makes a password slightly shorter in entropy but much easier to use.
Should I reuse a strong password?
No. Use a different password for every site. If one site is breached, attackers try the same email and password everywhere else. A password manager makes unique passwords easy.
What makes a password strong?
A strong password is long, random and unique. Attackers do not guess one password at a time by hand: they use lists of leaked passwords and computers that try billions of combinations a second. Random passwords from a generator avoid the patterns people use, like names, dates and keyboard runs, which are the first things those tools try.
The crack-time estimate assumes a fast offline attack at 100 billion guesses a second, which is close to the worst case. Real websites limit login attempts, so a strong password gives you a large safety margin.