How to generate a strong password
- Choose Password for random characters, Passphrase for several random words that are easier to type and remember, or PIN for digits only.
- Set the length and character types. 16 characters with all four types is a strong default for most accounts.
- Check the strength bar: it shows the entropy in bits and roughly how long a fast offline attack would need to guess it.
- Copy the password straight into your password manager or the sign-up form. Press ↻ for another, or generate a list in bulk.
What makes a password strong
Strength comes from unpredictability, measured as entropy. Every random character from the full 87-character set adds about 6.4 bits, so a 16-character password has around 100 bits: far beyond what any attacker can try. Passphrases get their strength from the number of words. This generator picks from about 24,000 common English words, so each word adds about 14.5 bits and five words give about 73 bits, while being much easier to type on a phone or remember for a master password.
Randomness matters: humans are bad at inventing passwords, which is why "Summer2024!" is guessed quickly despite meeting most rules. This page uses crypto.getRandomValues, the browser's cryptographically secure generator, with unbiased selection, and it guarantees at least one character of each type you choose. Nothing is transmitted, logged or saved.
Use a different password for every account, store them in a password manager, and turn on two-factor authentication wherever you can. Your password manager's master password is the one place where a long passphrase really shines.
Is it safe to generate passwords online?
With this page, yes: passwords are created in your browser and never sent anywhere. You can even load the page and then go offline before generating.
How long should a password be?
At least 12 characters, ideally 16 or more for random passwords, or five or more words for a passphrase.
Are passphrases as secure as passwords?
Yes, if the words are chosen randomly. Five random words from this list give about 73 bits of entropy, comparable to an 11- or 12-character random password.
How long would it take to crack?
The estimate assumes an attacker can test 10 billion guesses per second offline, which is a worst case for a leaked, poorly protected database.