How to use Password generator
- 1
Choose password or passphrase
Random characters suit a password manager; a passphrase of words is easier to type and remember.
- 2
Set the rules
Pick the length and character sets, or the number of words, separator and capitalisation.
- 3
Read the strength
Check the entropy in bits and the crack-time table; aim for at least 80 bits for important accounts.
- 4
Copy it into your manager
Copy the result and save it in your password manager before closing the page.
- 5
Test an existing password
Type a password you already use into Check my password to see how quickly it could be guessed.
Limits and Pro
Free with no sign-up: passwords of 4 to 128 characters, passphrases of 3 to 12 words, and up to 50 generated at once; the checker's 800 KB dictionary downloads once, the first time you use it.
Pro removes the ads; the generator and checker are identical on every plan. See Pro
About Password generator
This generator makes two kinds of secrets. Random passwords draw from lowercase and uppercase letters, digits and a symbol set you can edit, from 4 to 128 characters long, with options to leave out look-alike characters such as I, l, 1, O and 0 and to guarantee at least one character from every chosen set for sites with composition rules. Passphrases string together 3 to 12 words from the EFF Large Wordlist — 7,776 everyday words, each worth 12.9 bits — with your choice of separator, capitalisation and an optional number, so they are easy to type on a phone and to remember.
Every character and word is picked with the browser's cryptographic random generator using rejection sampling, which removes the small bias a simple modulo would add. The entropy shown is exact for the settings you chose, including the effect of the at-least-one-of-each rule, and the crack-time table turns it into average guessing times for four attack scenarios, from a rate-limited login form to a stolen database hashed with a fast algorithm on GPUs.
The separate checker rates a password you already use with zxcvbn, the open-source estimator that looks for dictionary words, names, keyboard walks, dates, repeats and l33t substitutions the way real cracking tools do, and explains what makes it weak.
Passphrase words come from the EFF Large Wordlist by the Electronic Frontier Foundation, used under the Creative Commons Attribution 3.0 United States licence. A generator can't store or sync passwords; keep them in a password manager.
Privacy
Passwords and passphrases are generated on your device with the Web Crypto API, and the checker runs zxcvbn locally in a Web Worker; nothing you generate or type is sent, logged or saved. Only your settings (length, character sets, word count) are remembered in local storage.
Features
Unbiased randomness
Web Crypto with rejection sampling, so every character and word is equally likely.
EFF passphrases
7,776-word list designed for memorable, typeable passphrases.
Realistic checker
zxcvbn spots words, names, dates and keyboard patterns in passwords you already use.