Advertisement
Guide
About the Password Generator
A strong password is simply one that's hard to guess — and the most reliable way to achieve that is to make it long and random. Human-chosen passwords tend to follow predictable patterns that attackers exploit; a randomly generated string does not. This generator builds passwords using your browser's cryptographically secure random number generator, so the output is genuinely unpredictable rather than pseudo-random.
Make a random password (with every character type you choose guaranteed to appear), a memorable diceware passphrase from the EFF wordlist, or a PIN. The strength meter shows the exact entropy and how long an attacker would need. The checker tab looks for what real crackers try first — common passwords, dictionary words, keyboard runs, sequences and years — rather than just counting character types.
What makes a password strong?
Strength comes down to entropy— the number of equally likely possibilities an attacker would have to search. Entropy grows with both the length and the size of the character set. Length matters most: adding characters multiplies the search space far faster than swapping in a few symbols. As a rule of thumb, aim for at least 16 characters for important accounts, and let a password manager remember them so length isn't a burden.
Passphrases and reuse
Two habits matter more than any single password: never reuse a password across sites, and use a password manager to store unique ones. If a site is breached, a unique password limits the damage to that one account. For passwords you must type by hand, a long random passphrase can be easier to enter than a dense symbol string while remaining strong.
How to use it
- 1Choose a random password, a passphrase or a PIN, and set the length.
- 2Pick the character sets, or the separator and case for a passphrase.
- 3Check the strength indicator, and regenerate until you are happy.
- 4Copy the password and store it in your password manager.
Frequently asked questions
Are these passwords safe to use?
Yes. They are generated with crypto.getRandomValues, a cryptographically secure source, entirely in your browser. Nothing is sent to a server, logged, or stored.
How long should my password be?
For important accounts, 16 characters or more is a good target. Length adds strength faster than anything else, and a password manager removes the pain of typing long passwords.
Should I include symbols?
Symbols increase the character set and add some strength, but length is more important. If a site rejects certain symbols, a longer alphanumeric password is a fine alternative.
Is it safe to generate a password on a website?
It depends on the site. Passwords here are generated in your browser and never sent anywhere — the page works offline. The only network request is the optional breach check, and that sends just the first 5 characters of a hash, never the password.
Passphrase or random password?
A five-word passphrase from the EFF list has about 64 bits of entropy — as strong as a random 11-character password with symbols — and is far easier to type and remember. Use passphrases for things you must type (a password manager’s master password, a laptop login) and random passwords for everything stored in a manager.
Why does the checker call “Password123!” very weak?
Because crackers do not try random strings first: they try common passwords, words with capitals and numbers added, and keyboard patterns. A password built from those pieces falls in seconds despite having upper case, digits and a symbol.
How does the breach check work?
It uses Have I Been Pwned’s range API. The password is hashed with SHA-1 in your browser, only the first 5 hex characters are sent, and the list of matching hashes that comes back is compared here. The service never sees your password or its full hash.
Should I reuse a strong password everywhere?
No. Reuse is the biggest real-world risk: one breached site exposes every account sharing that password. Generate a unique password per site and store them in a password manager.