Password Generator: Strong, Random & Private

How to use this password generator

1. Password: a new random password appears at once. Move the Length slider (or type a number up to 128) and choose the character types. Click Copy and paste it into the sign-up form or your password manager. New makes another one.
2. Symbols: the box lists the symbols that may be used. If a site accepts only some symbols, delete the others from the box. Avoid look-alikes leaves out characters such as I, l, 1, O and 0, which helps when you have to read the password aloud or type it from paper.
3. Passphrase: random words such as Glider-Unwind-Pasta7-Ripple-Frosty. Easy to remember and to type on a phone. Use 5 words or more, 6 for a master password.
4. PIN: random digits for a phone, card or door lock.
5. Many at once: make up to 100 passwords with the same settings, for example for test accounts, and copy or download them.
6. Check a password: type a password you use to see how quickly it could be guessed and why.

The strength line shows the bits of entropy (how many yes/no guesses the password is worth) and how long a fast offline attack, 10 billion guesses per second, would need on average.

What makes a password strong?

A password is strong when an attacker would need too many guesses to find it. Attackers do not try every possible string: they start with leaked passwords, dictionary words, names, years and keyboard patterns, and with the usual tricks like @ for a or a 1! at the end. So Summer2024! looks complex but falls in seconds.

A password made by a random generator has no pattern. The only way to find it is to try all possibilities, and their number grows very fast with length:

* On average, at 10 billion guesses per second: a strong offline attack on a database that stored passwords with a fast hash such as MD5 or NTLM. A site that uses bcrypt or Argon2 slows attackers down by a factor of thousands to millions, and an online login form allows only a few guesses per second. But you cannot know how a site stores your password, so plan for the bad case.

Rules that matter more than complexity

• Unique: one password per site. Most accounts are taken over with passwords leaked from another site (credential stuffing), however strong they were.
• Long: each extra random character multiplies the work by about 70 to 94. Length beats symbols.
• Random: made by a generator, not by you. People are bad at being random.
• Two-factor authentication (an app or a security key) protects you even when a password leaks.

Password or passphrase?

A random password like Rk3#q9v!zW7m&e2P packs the most strength into the fewest characters. It is ideal for everything a password manager fills in for you.

A passphrase uses random words, the "Diceware" method. Each word from the 7,776-word EFF list adds 12.9 bits, so 6 words give 77.5 bits, about the same as a 12-character password with all character types. Words are much easier to remember and type, so use a passphrase for the few passwords you must type yourself: the password manager's master password, your computer login, your phone backup.

The words must be chosen at random. A sentence you pick yourself, a quote or a song line is in attackers' word lists, and is far weaker than the number of words suggests.

Is this generator really random?

Yes. It uses crypto.getRandomValues(), the cryptographically secure random number generator built into every modern browser, which takes its randomness from the operating system. It does not use Math.random(), which is predictable.

Each character is picked with rejection sampling, so every allowed character has exactly the same chance (a simple random % 70 would make some characters slightly more likely). When you select several character types, the tool guarantees at least one of each by drawing again until all are present, which keeps every valid password equally likely. The bits shown already account for that rule.

Generate a secure password in code or on the command line

Never use Math.random(), Python's random module or Java's java.util.Random for passwords: their output can be predicted.

Frequently asked questions

Is it safe to use an online password generator?

This one, yes: the passwords are made in your browser with crypto.getRandomValues, the same secure random source that browsers use for encryption keys. Nothing is sent to a server, logged or saved, and the page also works offline once it has loaded. Your settings (length, character types) are remembered on your device, the passwords are not.

How long should a password be?

For accounts saved in a password manager, use 16 or more random characters; that is about 100 bits and cannot be guessed. If you must type or remember it, a passphrase of 5 or 6 random words is easier and just as strong. Never go below 12 random characters. Length matters more than adding symbols.

Is a passphrase better than a password?

For passwords you have to remember or type by hand, yes. Six random words from a 7,776-word list give about 77 bits, as much as a 12-character random password with symbols, but they are much easier to remember and type on a phone. The words must be chosen at random by the tool, not by you: a phrase you invent, like a song line, is far weaker.

What makes a password strong?

Only how many guesses an attacker needs. That depends on length and on true randomness, not on looking complicated. P@ssw0rd2024! has upper case, digits and symbols but is guessed in seconds, because attackers try words with common substitutions and years first. A random 16-character password, or 6 random words, has no pattern to guess.

How does the password strength checker work?

It looks for what attackers try first: very common passwords, dictionary words (also with 4 for a, 3 for e, 0 for o and similar), keyboard rows like qwerty, sequences like 123 or abc, repeated characters and years. Each part counts only as much as the guesses it really costs, and the total is shown in bits with an estimated time to guess. It runs on your device and the password is not sent or saved. It is an estimate, not a guarantee.

Why does a website reject my generated password?

Some sites limit the length (for example 20 characters) or allow only some symbols. Lower the length, or edit the symbol list so it only contains the symbols the site accepts, or turn symbols off and add 2 to 4 more characters instead: the strength stays the same. The tool always puts at least one character of each type you selected into the password.

How should I store my passwords?

Use a password manager (for example Bitwarden, 1Password, KeePassXC or the one built into your browser or phone) and a different random password for every site, so one leak does not open your other accounts. Protect the manager with one strong passphrase you remember, and turn on two-factor authentication for email, banking and the password manager itself.

More security tools

Passphrase word list: EFF Large Wordlist by the Electronic Frontier Foundation, CC BY 3.0 US.