Password Generator: Strong Passwords & Passphrases
Your password
An attacker who knows exactly how it was made would need about 2.8 × 10^38 guesses on average.
Generated on your device with the browser's cryptographic random number generator. Nothing is sent or stored.
How this works
Every character or word is picked with your browser's cryptographic random number generator (crypto.getRandomValues), using rejection sampling so no character is more likely than another. Nothing is generated on a server, sent over the network or saved.
Random passwords draw from the character types you switch on (26 lowercase, 26 uppercase, 10 digits, 25 symbols) and always include at least one of each. Strength is shown as entropy: the base-2 logarithm of how many passwords the settings could produce. A 20-character password with all four types has about 129 bits; a 12-character one has about 77 bits.
Passphrases join words picked at random from the EFF short wordlist of 1,296 words, so each word adds about 10.3 bits. Five words plus one random digit gives about 57 bits, six words about 62 bits. Capitalising words does not add strength because it is predictable, but it satisfies sites that demand an uppercase letter.
As a rule of thumb, under 40 bits is weak, 60 bits and up is strong for an online account, and 80 bits and up is very strong. A unique password per site, kept in a password manager with two-factor authentication switched on, matters more than any single password's length.
FAQs
How long should a strong password be?
At least 16 random characters, which gives about 103 bits of entropy with all four character types. Even 12 random characters (about 77 bits) is far beyond guessing, as long as the password is unique to one site.
Is a passphrase better than a password?
It is easier to remember and type, and just as strong if it is long enough: six random words from a 1,296-word list give about 62 bits, similar to a 10-character random password with all character types. Use one for logins you type by hand.
Is it safe to use an online password generator?
Only if the password is made on your device. This one runs in your browser with the built-in cryptographic random generator and sends nothing to any server, so you can even use it offline once the page has loaded.
What does bits of entropy mean?
It measures how many equally likely passwords your settings could produce: n bits means 2 to the power of n possibilities. Each extra bit doubles the work for an attacker, so 60 bits is about a million times harder to guess than 40 bits.