Advertisement
Guide
About the Password Generator
A strong password is simply one that's hard to guess — and the most reliable way to achieve that is to make it long and random. Human-chosen passwords tend to follow predictable patterns that attackers exploit; a randomly generated string does not. This generator builds passwords using your browser's cryptographically secure random number generator, so the output is genuinely unpredictable rather than pseudo-random.
Make a random password (with every character type you choose guaranteed to appear), a memorable diceware passphrase from the EFF wordlist, or a PIN. The strength meter shows the exact entropy and how long an attacker would need. The checker tab looks for what real crackers try first — common passwords, dictionary words, keyboard runs, sequences and years — rather than just counting character types.
What makes a password strong?
Strength comes down to entropy — the number of equally likely possibilities an attacker would have to search. Entropy grows with both the length and the size of the character set. Length matters most: adding characters multiplies the search space far faster than swapping in a few symbols. As a rule of thumb, aim for at least 16 characters for important accounts, and let a password manager remember them so length isn't a burden.
Passphrases and reuse
Two habits matter more than any single password: never reuse a password across sites, and use a password manager to store unique ones. If a site is breached, a unique password limits the damage to that one account. For passwords you must type by hand, a long random passphrase can be easier to enter than a dense symbol string while remaining strong.
How to use it
- 1Choose a random password, a passphrase or a PIN, and set the length.
- 2Pick the character sets, or the separator and case for a passphrase.
- 3Check the strength indicator, and regenerate until you are happy.
- 4Copy the password and store it in your password manager.
Frequently asked questions
Are these passwords safe to use?
Yes. They are generated with crypto.getRandomValues, a cryptographically secure source, entirely in your browser. Nothing is sent to a server, logged, or stored.
How long should my password be?
For important accounts, 16 characters or more is a good target. Length adds strength faster than anything else, and a password manager removes the pain of typing long passwords.
Should I include symbols?
Symbols increase the character set and add some strength, but length is more important. If a site rejects certain symbols, a longer alphanumeric password is a fine alternative.
Is it safe to generate a password on a website?
It depends on the site. Passwords here are generated in your browser and never sent anywhere — the page works offline. The only network request is the optional breach check, and that sends just the first 5 characters of a hash, never the password.
Passphrase or random password?
A five-word passphrase from the EFF list has about 64 bits of entropy — as strong as a random 11-character password with symbols — and is far easier to type and remember. Use passphrases for things you must type (a password manager’s master password, a laptop login) and random passwords for everything stored in a manager.
Why does the checker call “Password123!” very weak?
Because crackers do not try random strings first: they try common passwords, words with capitals and numbers added, and keyboard patterns. A password built from those pieces falls in seconds despite having upper case, digits and a symbol.
How does the breach check work?
It uses Have I Been Pwned’s range API. The password is hashed with SHA-1 in your browser, only the first 5 hex characters are sent, and the list of matching hashes that comes back is compared here. The service never sees your password or its full hash.
Should I reuse a strong password everywhere?
No. Reuse is the biggest real-world risk: one breached site exposes every account sharing that password. Generate a unique password per site and store them in a password manager.