Password Generator
Strong random passwords, easy-to-type passphrases and PINs, with an honest estimate of how long each would take to crack.
Time to crack at ten billion guesses a second: . Fine for a phone or card that locks after a few wrong tries, never for an online account.
generated
16 or more for important accounts. Type up to 128 in the box.
6 words is a good balance; use 7 or more for a password manager’s master password.
Words come from the EFF short word list (1,296 words, CC BY 3.0).
Already have a password?
See how it holds up in the Password Strength Checker. Building a login? Store passwords with the Bcrypt Generator, never as plain text.
Need a token, not a password?
For API keys and secrets, use the Random String Generator. For database IDs, use the UUID Generator.
About the Password Generator
The password generator makes random passwords, passphrases, and PINs with your browser’s cryptographically secure random number generator, so nobody can predict them. It shows the strength in bits of entropy and how long an attacker would need to guess each one.
How to use it
- 1 Choose Password, Passphrase, or PIN.
- 2 Set the length and the characters or words to use; 16+ characters or 6+ words is best.
- 3 Copy it into your password manager, or make up to 100 at once and download them.
Frequently asked questions
How long should a password be?
At least 12 characters, and 16 or more for important accounts such as email and banking. Each extra character multiplies the guesses needed, so length adds more strength than symbols do.
Password or passphrase: which is better?
Both are strong when long enough. A random 16-character password has about 100 bits of entropy; a 6-word passphrase has about 62 bits but is far easier to type and remember. Use a passphrase for things you type by hand, like your computer login or password manager.
How is the crack time worked out?
It assumes an attacker who stole a password database and makes ten billion guesses a second, which a few graphics cards can do against a fast hash. The time shown is the average: half of all possibilities. Online logins are far slower to attack, so the real time is usually much longer.
Are the passwords random and private?
Yes. They come from crypto.getRandomValues, the browser’s secure random number generator, with no bias toward any character. They are made on your device and never sent to our server or saved. Only your settings are remembered in this browser.
Why leave out look-alike characters?
Characters such as I, l, 1, O, and 0 are easy to misread when you copy a password by hand or read it aloud. Leaving them out makes the password a little weaker per character, so add a character or two to make up for it.
Is a 4-digit PIN safe?
Only where a lock stops guessing after a few wrong tries, like a phone or bank card. There are just 10,000 four-digit PINs, so never use one as an online password.
Where do the passphrase words come from?
From the EFF short word list by the Electronic Frontier Foundation: 1,296 short, common words chosen to be easy to type and hard to confuse. It is used under the CC BY 3.0 US licence.