Strong Password & Passphrase Generator

Create a random password of any length from 8 to 128 characters, or a passphrase of 3 to 8 words. Each result comes with an entropy score, and nothing leaves your browser.

All options in Developer Utilities

How to Use Password Generator

Choose password or passphrase

Select Password for a random string of characters, or Passphrase for a sequence of random words that is easier to type and remember.

Set the length and character types

Pick a length from 8 to 128 characters and turn uppercase, lowercase, numbers and symbols on or off. Excluding ambiguous characters such as 0, O, l and 1 helps when the password will be read aloud or typed by hand.

Check the strength rating

The entropy score estimates how hard the result is to guess. Aim for at least 80 bits for important accounts and more for master passwords.

Copy it into your password manager

Copy the result and save it straight away. Press Generate Again for a new one; nothing is stored or sent anywhere.

Password Generator Guide

What makes a password strong

Strength comes from unpredictability, measured in bits of entropy. A password drawn at random from 94 printable characters gains about 6.5 bits per character, so 16 characters give roughly 105 bits, far beyond what any offline attack can search. Length matters more than adding one more symbol: going from 12 to 16 characters adds more strength than any character rule.

The other half is the randomness source. This generator uses the browser's cryptographic random number generator (crypto.getRandomValues), not Math.random(), and guarantees at least one character from each set you enable.

Passwords vs passphrases

Random character passwords are best for anything stored in a password manager. Passphrases, several random words joined by a separator, are easier to type and remember, which makes them a better fit for the few secrets you have to type by hand: your password manager's master password, a disk encryption key, or a Wi-Fi network. Four random words from a large list already give more entropy than most people's "complex" passwords.

Options that help in practice

Exclude look-alike characters (0, O, I, l and 1) when a password will be read aloud or typed from a screen. Turn symbols off for systems that reject them, and make up the difference with extra length. For passphrases, choose the separator and capitalization a site accepts.

Frequently Asked Questions

How long should a password be?

For an account protected by a password manager, 16 to 20 random characters is a good default. For a passphrase you need to remember, five or six random words gives similar strength. Length matters more than special characters, because each extra character multiplies the number of possibilities.

Are passwords generated in a browser safe?

They are when the browser's cryptographic random generator is used, as it is here. The password is created on your device and never sent to a server. The real risk is what happens next, so store it in a password manager rather than a note or spreadsheet.

Why do some sites reject my generated password?

Some sites limit length or allowed symbols. If a password is rejected, turn off symbols or reduce the length to what the site allows, then make up for it with a longer password where you can.

Should I change my passwords regularly?

Current guidance from NIST and others says no, unless there is a sign of compromise. Forced regular changes tend to produce weaker, predictable passwords. Use a unique password for every site and turn on two-factor authentication where it is offered.