Password generator
Generate strong passwords and easy-to-remember passphrases, with entropy and estimated time to crack explained honestly. All in your browser.
Password and passphrase generator
Average time to guess by trying combinations
Guessing on the website, no lockout
longer than the age of the universe
10 guesses per second. Most sites lock you out much sooner.
Leaked passwords, slow hash
longer than the age of the universe
10 thousand per second (bcrypt, scrypt, Argon2).
Leaked passwords, fast hash
longer than the age of the universe
100 billion per second (MD5 or SHA-1 on a high-end graphics card).
How this is calculated (and what it doesn't tell you)
Entropy measures how many different passwords the generator could have drawn with these options: N bits means 2^N equally likely possibilities. Each extra bit doubles the work for whoever is guessing.
We assume the worst: the attacker knows exactly how the password was generated (length, character types or word list) and, on average, succeeds after trying half of the possibilities.
The math only holds for randomly drawn passwords like these. Passwords made up by people (names, dates, “Password@123”, swapping a for @) follow patterns that cracking tools try first, so they fall much sooner than the numbers suggest.
Speeds are orders of magnitude: they depend on how the site stores passwords and on the attacker's hardware, and they grow over time.
No password protects you from phishing, malware on your device or a site that stores passwords carelessly. Use a different password for each site, a password manager and two-factor authentication.
Everything runs in your browser, using your device's cryptographic generator (crypto.getRandomValues): nothing you generate or type is sent or stored.
Tip: keep your passwords in a password manager and turn on two-factor authentication for important accounts.
How to use
- Choose Random password (to store in a password manager) or Passphrase (for the one password you have to memorize, like your password manager's or your computer's).
- Adjust the length, character types or number of words. The password updates instantly, and the estimated strength bar shows how many bits of entropy it has.
- Tap Copy and paste it into the sign-up form. Need several? Generate 5 or 10 at once and copy them all.
Nothing leaves your device: passwords are drawn in the browser with crypto.getRandomValues, the operating system's cryptographic generator, and are never sent or stored.
What makes a password strong
A password is strong when nobody can guess it in a useful amount of time, even with software that tries billions of guesses per second. That depends on two things:
- Being random, not made up. People pick names, dates, words with "a" swapped for "@" and the classic "Password@123". Cracking tools try those patterns first.
- Having lots of possible combinations. Each extra character multiplies the attacker's work. Length matters more than variety: 16 random lowercase letters (75 bits) beat 10 characters mixing everything (64 bits).
Entropy in a nutshell
Entropy measures how many passwords the generator could have produced with the chosen options. N bits means 2^N equally likely possibilities, and every extra bit doubles the attacker's work.
- Random password: length × log₂(number of possible characters). Lowercase, uppercase, digits and 24 symbols make 86 characters, about 6.4 bits each: 16 characters give ≈ 103 bits.
- With one of each type, the tool counts only the combinations that follow the rule (inclusion–exclusion), so the estimate is slightly below the simple formula, and exact.
- Passphrase: words × log₂(list size). The lists here have 1,024 words, which is 10 bits per word. Six words plus two digits give ≈ 66.6 bits.
Random password or passphrase?
- Random password (e.g.
k7#Rq2!vZ@m9Lp4x): lots of strength in few characters, but hard to memorize and to type on a phone. Best for accounts stored in a password manager. - Passphrase (e.g.
Maple-Kettle-Brisk-Clover-Sock-Wind-47): needs more characters for the same strength, but is easy to remember, read out and type. Best for your password manager's master password, your computer login and your home Wi-Fi.
With a passphrase, the security comes from the random draw, not from the words: an attacker can know the whole list and still face far too much work. Capitalization and the separator help with site rules but add no entropy, because they are always the same.
Why time-to-crack is only an estimate
The tool shows the average time to guess the password in three scenarios: guessing directly on the website (10 per second), leaked passwords protected by a slow hash such as bcrypt or Argon2 (10 thousand per second), and leaked passwords with a fast hash such as MD5, attacked with a high-end graphics card (100 billion per second).
These are orders of magnitude, not promises. The math assumes a realistic worst case: the attacker knows exactly how the password was generated and, on average, succeeds after trying half of the possibilities. It does not apply to passwords people make up, and it ignores attacks that skip guessing altogether, such as phishing, malware on your device or a site that stores passwords carelessly.
Password managers and two-factor authentication
- A different password for every site. When one site leaks, criminals try the same email and password everywhere else.
- Use a password manager (your browser's, your phone's or a dedicated app). It creates, stores and fills in passwords; you only memorize one strong passphrase.
- Turn on two-factor authentication (an authenticator app or a security key) for email, banking and social media. Even if a password leaks, it is not enough on its own.
How the tool works
- Random numbers come from
crypto.getRandomValues, the same generator used for cryptography. - Each character or word is picked without bias: instead of using the remainder directly (which favors the first items), we discard the few values that would cause unevenness and draw again (rejection sampling).
- With one of each type, the whole password is drawn and redrawn if a type is missing, instead of reserving positions. The password stays uniform and the entropy shown is the real one.
- Quotes, backtick, backslash, comma, space and
< > |are left out of the symbols because they often break forms, spreadsheets and terminals. Avoid look-alike characters removes I, l, 1, O, 0 and o.
FAQ
Are the generated passwords saved anywhere? No. They only live in the memory of the open tab. Close it or generate another, and the previous one is gone. Nothing is sent to a server.
What length should I use? For passwords stored in a manager, 16 characters or more. For a passphrase you will memorize, 6 words or more from the 1,024-word list.
A site doesn't accept symbols. What now? Uncheck Symbols and increase the length: 20 letters and digits give about 119 bits.
Can I trust an online tool to generate passwords? This one runs entirely in your browser and keeps working offline once loaded. If you prefer, generate the password right in your password manager: what matters is that it is random and unique.