How to generate a strong password
- Pick Password or Passphrase mode.
- For passwords, set the length and choose character sets; for passphrases, set the word count, separator and options.
- Check the strength meter, bits of entropy and estimated crack time.
- Click Copy, or Generate new for another one; use Generate list for up to 100.
What you can do with Password Generator
- Random passwords
- Lengths from 4 to 128 characters with uppercase, lowercase, digits and symbols, and at least one character from every set you select.
- Memorable passphrases
- Combine 3 to 12 random words from a list of about 870, with your choice of separator, capitalization and an added digit.
- Exclude look-alikes
- Drop characters like I, l, 1, O and 0 that are easy to misread when typing a password from paper or another screen.
- Strength meter
- Shows bits of entropy, a Weak to Very strong rating and the time to crack at 10 billion guesses per second.
- Bulk generation
- Generate up to 100 passwords or passphrases in one list, each with its own copy button.
- Secure randomness
- Uses crypto.getRandomValues with unbiased sampling instead of Math.random, so results can't be predicted.
Password entropy, length and passphrases explained
Password strength comes down to entropy: how many guesses an attacker would need. A random password's entropy is its length times log2 of the character pool. A 16-character password drawing on all four sets here (about 87 characters) has roughly 103 bits, far beyond any practical brute-force attack. Length matters more than complexity, which is why NIST's current guidance favors long passwords and passphrases over forced symbol rules, and recommends checking new passwords against lists of known breached ones.
Passphrases trade some length for memorability. With a list of about 870 words, each word adds nearly 10 bits, so six random words give roughly 59 bits plus a little more for the added digit, while four words suit only low-value accounts. The key is that the words are chosen randomly, not by you. For most accounts the best practice is a unique random password per site stored in a password manager, protected by a strong passphrase as the master password.
Frequently asked questions
Are generated passwords sent anywhere or stored?
No. Passwords are generated on your device with the browser's cryptographic random number generator and are never transmitted, saved or logged. Once you close the tab they exist only where you've pasted them, ideally a password manager.
How long should my password be?
For random passwords using mixed character types, 16 characters or more is a strong choice for everyday accounts, and 20 or more for email, banking and password manager master keys. For passphrases, use at least five or six random words.
Is a passphrase more secure than a random password?
Not automatically. Per character, a random password packs in more entropy. But a passphrase of six or more random words is both strong and far easier to remember and type, which makes it ideal for passwords you can't keep in a password manager.
What does the crack time estimate mean?
It's the average time to guess the password by brute force at 10 billion guesses per second, a rate achievable offline with powerful hardware against fast hashes. It assumes the attacker knows how the password was generated, so it's a cautious estimate.
Why are some symbols missing?
The symbol set uses 25 common characters that most websites accept. Quotes, backslashes, backticks and spaces are left out because some sites reject them or they cause trouble when typed or pasted. Turn symbols off entirely if a site doesn't allow them.