Password Generator creates strong random passwords or easy-to-type passphrases. Choose the length and character sets, or a number of words, and see the strength in bits with an estimate of how long it would take to crack. Passwords are made with your browser’s cryptographic random generator and are never stored or sent.
How to make a password
- Choose Random password or Passphrase (words).
- For a password, set the Length from 6 to 64 and tick the sets you want: A–Z, a–z, 0–9 and Symbols. Tick Avoid look-alikes if you need to read it out or type it by hand.
- For a passphrase, set the number of Words from 3 to 10, pick a Separator, and choose whether to Capitalise words or Add a number.
- Click Copy. Click New password for another one.
- Need several? Under Make many at once, pick how many (5 to 100), click Generate list and Copy all.
How strength is measured
| Strength | Bits | Example |
|---|---|---|
| Weak | under 40 | 6 characters, letters only |
| Fair | 40–59 | 8 characters from all four sets |
| Strong | 60–79 | 12 characters, letters and numbers |
| Very strong | 80 and more | 16 characters from all sets, or 8 words |
Bits count the possible combinations: a password of 16 characters picked from all 87 letters, digits and symbols has about 103 bits. The time to crack assumes an attacker who tries 100 billion passwords a second against a stolen database. Online login forms allow far fewer tries, so real accounts are safer than the figure, but a strong password protects you even when a site is breached.
Passwords or passphrases
A random password like q7#Vt2!mRw9$eLp4 packs the most strength into the fewest characters. It is ideal for a password manager, which types it for you.
A passphrase like crisp-otter-banjo-tulip-mower is a few random words. It is longer but much easier to remember and to type on a phone or a TV. Words are chosen from the EFF short word list of 1,296 common, easy-to-spell words published by the Electronic Frontier Foundation. Each word adds a little over 10 bits, so five words give about 52 bits and seven about 72. Add a number or capitals if a site demands them.
Every chosen set is used
When you tick several sets, each password contains at least one character from every set. That way it always passes sign-up rules such as “must contain a number and a symbol”, without you generating it again.
Why the randomness matters
Passwords people make up follow patterns: a word, a capital at the start, a number and an exclamation mark at the end. Attackers try those patterns first. This generator uses crypto.getRandomValues, the browser’s cryptographic generator, and picks every character without modulo bias, so no character is more likely than another. The only pattern is the one you choose with the settings.
Good password habits
- One password per account. Reuse is the main way one leak becomes many.
- Use a password manager and let it fill passwords in for you.
- Turn on two-factor sign-in for email, banking and social accounts.
- Change a password when a site reports a breach, not on a fixed schedule.
- Check what you share online. Before posting a photo, remove the location and camera data from it.
Private by design
Passwords are generated on your own device and only exist on your screen. Nothing is stored or sent. See how it works.