Strong password generator
Create random passwords from 8 to 128 characters, or passphrases made of real words. Pick the characters you need and see how strong the result is. Passwords are made on your device and never stored.
Everything runs on your device. Nothing you add or type is sent to any server.
How to use it
- 01
Choose Password for random characters, or Passphrase for a string of words that is easier to type and remember.
- 02
Set the length or the number of words, and pick the character types. Tick Avoid look-alike characters if you will type the password by hand.
- 03
Choose how many to create at once and press Generate. Copy the one you like with the copy button next to it, and save it in your password manager.
How the passwords are made
Every character or word is picked with your browser's cryptographic random generator (crypto.getRandomValues), not with the ordinary random function used for games. Numbers are drawn without modulo bias, so every character in the pool is equally likely.
When you choose several character types, each password contains at least one of each. Instead of forcing, say, a digit into the first position, the tool draws the whole password again until every type is present. That keeps all valid passwords equally likely and gives no pattern to guess.
What the entropy number means
Entropy in bits measures how many possible passwords the settings allow: each extra bit doubles the number of guesses an attacker would need in the worst case. For passwords the figure is exact, counting only passwords that contain every chosen type. For passphrases it is the number of words times about 10.3 bits, because the list has 1,296 words. Capital letters added by the Capitalise option add nothing, since they are not random.
The labels Weak (below 50 bits), Fair (50 to 69), Strong (70 to 99) and Very strong (100 or more) are this site's own rough guide, not an official standard. Use a different password for every account.
The word list
Passphrases use the EFF Short Wordlist #1: 1,296 English words of at most five letters, which the Electronic Frontier Foundation picked to be memorable and distinct. It is used unchanged under the Creative Commons Attribution 4.0 licence.
Frequently asked questions
Are my passwords saved or sent anywhere?
No. They are created in your browser, shown on screen and forgotten when you leave or refresh the page. Nothing is uploaded, logged or kept in storage.
Which characters count as look-alikes?
Capital I, small l, the digit 1, capital O, small o, the digit 0 and the bar |. Leaving them out makes a password easier to read, at the cost of a little entropy.
Which symbols are used?
Common punctuation such as ! # $ % & * @ and brackets. Quotes, backslash, backtick and space are left out because they can break some forms, command lines and config files.