About the Password Generator
This password generator uses your browser’s cryptographically secure random number generator (crypto.getRandomValues). Passwords people make up follow patterns – birthdays, names, keyboard walks – and are easy to guess. A randomly generated password has no pattern to exploit.
When you select uppercase, lowercase, numbers and symbols, every selected type is guaranteed to appear at least once, so the password passes typical site requirements. Passwords are never sent to a server or stored.
How to use
- Choose Random characters or Memorable words.
- Set the length (or number of words) and the character types. New passwords appear instantly.
- Check the strength bar and entropy. 80 bits or more is recommended for important accounts.
- Click Copy next to the password you like. Need other options? Click Generate.
Password strength (entropy) explained
Entropy measures how many guesses an attacker needs, expressed as a power of two. It is calculated as length × log₂(size of the character set). Every extra bit doubles the time needed to crack the password.
| Entropy | Strength | Example |
|---|---|---|
| under 40 bits | Weak | 8-digit PIN, 8 lowercase letters |
| 40–59 bits | Fair | 8–9 letters and numbers, mixed case |
| 60–79 bits | Strong | 10–12 characters of all four types |
| 80 bits or more | Very strong | 13+ characters of all four types, 9 words + 2 digits |
The estimated crack time is an average for an offline attack making 10 billion guesses per second.
Memorable passphrases
A passphrase like Piano-River-Cloud-Tiger-42 strings random English words together. It is long but easy to remember and type. Each word comes from a list of about 400, so it adds roughly 8.6 bits; six words plus two digits give about 58 bits. Passphrases are ideal for things you type by hand, such as a computer login or the master password of a password manager. Use seven or more words for important accounts.
Tips for using passwords safely
- Use a different password for every site. If one site is breached, reused passwords put all your other accounts at risk.
- Store passwords in a password manager (Apple Passwords, Google Password Manager, Bitwarden, 1Password) so you don’t have to remember them.
- Turn on two-factor authentication or passkeys wherever available.
FAQ
Are the generated passwords stored anywhere?
No. Passwords are created inside your browser and never sent to a server. Only your settings, such as length and character types, are remembered on this device.
A website rejects my symbols. What should I do?
Some sites only allow certain symbols. Turn symbols off and add two or three characters to the length, or pick another candidate that doesn’t contain the rejected character.
What does “exclude look-alike characters” do?
It removes characters that are easy to confuse in some fonts: uppercase I, lowercase l, the digit 1, uppercase O, the digit 0 and lowercase o. Useful for passwords you write down or read out to someone.
How long should a password be?
With all four character types, use at least 12 characters, and 16 or more for important accounts. If you store it in a password manager, 20+ characters costs you nothing.