Password & Passphrase Generator
Make a random password or a memorable passphrase on your own device, and see how strong it is.
Drop your file hereTap to choose a file
or click to browse, or paste from the clipboard
Truly random, made on your device
Each character or word is chosen with your browser's cryptographic random number generator, with an even chance for every option. The result is created on your device and is never sent, logged or saved.
Passwords or memorable passphrases
Make a random password of 4 to 128 characters from the character types you choose, or a passphrase of 3 to 12 everyday words from the EFF Long Wordlist that is easier to remember and to type.
Strength you can check
Every result shows its entropy in bits, a plain rating and the average time to guess it at a stated speed, so you can compare settings instead of trusting a colored bar.
How to create a strong password or passphrase
- 1
Choose Random password or Passphrase of words.
- 2
Set the length or number of words and the character types or separator you want.
- 3
Check the strength shown under the result and adjust until it is strong or very strong.
- 4
Select Copy and save the result in your password manager.
What people use this tool for
- Create a unique password for every new account so one leak cannot unlock the others.
- Make a master passphrase for a password manager that you can remember and type.
- Generate a Wi-Fi key or device PIN replacement that guests can read and enter easily.
- Produce a batch of initial passwords when setting up accounts for a team or a class.
Frequently Asked Questions
How do I generate a strong password?
Leave the mode on Random password and choose a length; 16 characters with all four character types is a good default. A new password appears whenever you change a setting or select Generate another. Select Copy and paste it straight into your password manager or the sign-up form.
Is it safe to generate a password on a website?
This generator runs entirely in your browser. The password is produced by the Web Crypto random source on your own device and is not sent to our server, written to storage or included in any analytics. It disappears when you leave the page. The safest habit is still to save it in a password manager immediately rather than leaving it on screen.
What is a passphrase, and when should I use one?
A passphrase is several random words, such as five words joined by hyphens. It is long but easy to read and type, which makes it a good choice for the few secrets you must remember or enter by hand: a password manager's master password, a laptop login or a Wi-Fi key. For everything else, a random password stored in a password manager is fine.
What does the entropy number mean?
Entropy counts how many different results the generator could have produced with your settings, written as a power of two. A password with 80 bits is one of 2 to the 80th equally likely possibilities, and each extra bit doubles the work of guessing it. The rating treats under 40 bits as weak, 40 to 60 as fair, 60 to 80 as strong and 80 or more as very strong.
How strong is a passphrase compared with a password?
Each word from the 7,776-word list adds about 12.9 bits. Five words give about 65 bits and six words about 78 bits, similar to a random 12-character password that uses all four character types. Capitalizing words does not add strength, because it is applied the same way every time. Adding a digit adds a few bits.
How is the time to guess worked out?
It is simple arithmetic: half of all possible results, divided by ten billion guesses per second, which is a fast offline attack against a poorly protected password database. Real attacks vary enormously. Online services that limit login attempts are far slower to attack, and a password that has leaked or been reused can be broken instantly however random it was. Use the figure to compare settings, not as a guarantee.
What do the two rules for passwords do?
Include at least one of each chosen type guarantees, for example, a digit and a symbol, which many sites require; the strength shown already accounts for it. Avoid look-alike characters leaves out O, 0, o, I, l and 1, which helps when a password has to be read aloud or typed from a screen, at a small cost in strength.
A site rejected my password. What should I change?
Sites differ in what they accept. If a symbol is refused, clear Symbols and add a few characters to the length to make up the strength. If there is a maximum length, lower the Length slider to it. If a site demands a digit or capital letter in a passphrase, turn on Add a digit to one word and Capitalize each word.