Password Generator
Generate a strong password or a memorable passphrase. Everything is produced by your browser’s cryptographic random number generator and never leaves your device.
What makes a password strong
Length matters far more than complexity. A password's strength is measured in bits of entropy — roughly, how many guesses an attacker needs. A 20-character random password drawn from all four character types carries about 128 bits, which is unbreakable with any foreseeable technology. A four-word passphrase like Cactus-Harbor-Velvet-Pigeon carries around 32 bits from the words alone but is vastly easier to remember and type, which is why adding a fifth or sixth word beats adding symbols. Substituting @ for a adds almost nothing, because attackers try those substitutions first.
How long should a password be?
Assuming an attacker who has stolen a password database and can attempt 100 billion guesses a second offline, here is how a fully random password holds up.
| Length (all 4 types) | Entropy | Time to crack |
|---|---|---|
| 8 characters | ~51 bits | Around 3 hours |
| 12 characters | ~77 bits | ~20,000 years |
| 16 characters | ~102 bits | Far longer than the universe has existed |
| 20 characters | ~128 bits | Effectively never |
The jump from 8 to 12 characters is worth more than every symbol substitution combined. Sixteen is a comfortable modern default.
When to use a passphrase instead
Use a random character string for anything stored in a password manager, which is most of your accounts. Use a passphrase for the handful you must type from memory: your device login, your password manager's master password, and your disk encryption key.
Passphrase strength comes entirely from the number of words and the size of the word list, not from cleverness. Four words from this tool's 264-word list gives about 32 bits; six words gives about 48. If a passphrase is protecting your entire password manager, use six words or more.
A phrase you invented yourself is much weaker than it feels, because human word choice is predictable. Let the tool pick.
Rules worth following
- Never reuse a password. Reuse is how one site's breach becomes a break-in everywhere else. This is the single most important rule.
- Use a password manager. It removes any need to remember or invent passwords, and it will not be fooled by a look-alike phishing domain.
- Turn on two-factor authentication wherever it is offered, preferring an authenticator app or a hardware key over SMS.
- Stop rotating passwords on a schedule. NIST dropped that advice because forced changes push people towards predictable patterns like
Summer2026!. Change a password when there is a reason to. - Longer beats weirder. Adding characters raises strength exponentially; adding punctuation to a short password barely moves it.
How to use the Password Generator
- Choose random characters for maximum strength, or memorable words for something you can type from memory.
- Set the length. Aim for at least 16 characters, or 5 words.
- Press Generate until you get one you like, then Copy.
- Paste it into your password manager rather than trying to memorise it.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated inside your browser using crypto.getRandomValues, the same cryptographically secure source that browsers use for encryption keys. Nothing is transmitted, logged or stored — you can disconnect from the internet and the tool still works.
What is entropy in a password?
It is a measure of unpredictability in bits. Each extra bit doubles the number of guesses needed. Below 40 bits is weak, 80 bits is strong, and above 100 bits is beyond brute force for the foreseeable future.
Are passphrases really as secure as random passwords?
They can be, if you use enough words. Four words is roughly equivalent to a short random password; six words is comparable to a strong one. The advantage is that you can actually remember and type it.
Should I change my passwords regularly?
Not on a schedule. Current NIST guidance says to change a password only when you have reason to believe it has been exposed, because forced rotation leads people to predictable variations.
Why does the tool offer to avoid look-alike characters?
Because 0 and O, or 1 and l, are easy to confuse when reading a password aloud or copying it by hand. Excluding them slightly reduces entropy, so add a character or two to compensate.
Related tools
Last reviewed September 4, 2026. Results are estimates for general information only.