Skip to content

Password & Passphrase Generator

Make strong random passwords or easy-to-type passphrases with your browser's secure random generator, with an honest strength estimate. Nothing is stored or sent.

Private · on device. Runs in your browser: your file is not uploaded. No sign-up.

Your password

Made on this device with crypto.getRandomValues. Never stored or sent.

How strong is it?

Very strong · about 101 bits

Trying half of all the passwords these settings can make would take longer than the age of the universe many times over at ten billion guesses a second, the speed of a well-equipped attacker with a stolen password file. A website that limits login attempts is far slower to attack than that.

The estimate is for a randomly made password, as here. The same length chosen by a person, or reused on several sites, is much weaker.

Truly random, never sent

Random passwords are drawn one character at a time from the sets you choose, with at least one from each so sites that demand a digit or a symbol accept them. Each pick is unbiased: numbers that would make some characters slightly more likely than others are thrown away and drawn again.

Honest strength

The meter shows the real arithmetic for a randomly made password, not a guess from looking at it. The same rules do not apply to a password you invent, because people are predictable. Generate, copy into your password manager, and you never need to remember it.

Frequently asked questions

Is it safe to make a password on a website?

This page makes the password in your browser with crypto.getRandomValues, the same secure generator password managers use, and never sends or stores it. You can check: the page works with your internet switched off once loaded.

How is the strength worked out?

From the number of possible passwords the settings could produce: length × log2(number of characters available), in bits. Every extra bit doubles the work for an attacker. Around 60 bits resists online guessing easily; 80 bits or more resists an offline attack on a stolen password file. The time shown assumes ten billion guesses a second.

Password or passphrase?

Each word the tool picks adds about 9.5 bits, so six words give about 57 bits (roughly a 9-character random password using all four sets) and seven give about 67. A passphrase such as Lagoon-Tulip-Cobalt-Maple-Frost-Pebble is longer to type but far easier to remember and to type correctly. Use passphrases for what you type yourself (a computer login, your password manager) and random passwords for what a password manager fills in for you.

Why leave out look-alike characters?

I, l, 1, |, O, 0 and o are easy to misread when a password is written down or read out. Leaving them out costs a little strength (made up by one more character) and saves mistakes.

Why is a passphrase made by the tool stronger than one I make up?

People pick words that go together, a song lyric or a phrase, which attackers try first. The tool picks each word at random from a list of 747, giving about 9.5 bits per word whatever you might have chosen.

Should I reuse a strong password?

No. When one site is breached, attackers try the same email and password everywhere else. Use a different password for every account and keep them in a password manager.