Password Generator

Password Generator

Set the length, choose how many passwords you want, tick the character types to include, and click Generate Password. Copy the one you want with the Copy button.

Each character is picked using your browser's cryptographic random number generator, the same source used for encryption keys.

Passwords are generated in your browser and never sent to our server.

What makes a password strong

A random password's strength depends on two things: how long it is, and how many different characters each position could be. Security people measure this in bits of entropy. Every extra bit doubles the number of guesses an attacker would need.

Each extra character adds about 6 bits. Switching on symbols adds only about 0.6 bits per character. So a 16-character password of letters and numbers is far stronger than a 12-character one that uses every symbol on the keyboard. If you have to choose, add length.

For a sense of scale: even at a trillion guesses per second, which is far beyond what's realistic against a properly stored password, 80 bits would take around 20,000 years to crack on average.

Websites limit how many login attempts you can make, so nobody guesses passwords through the login page. The real risk is a leaked password database. How fast attackers can work through one depends on how well the site stored its passwords, and you have no control over that. A long random password keeps you safe either way.

Good lengths:

• Accounts in a password manager: 16 characters or more.
• Wi-Fi password: 20 or more. It can be up to 63 characters, and you rarely type it.

The character options

Lowercase, uppercase, numbers and symbols. Tick everything the site or app allows. Each type makes the pool of possible characters bigger.

Brackets and punctuation. Brackets, slashes, quotes and punctuation marks:

{ } [ ] ( ) /  ' " ` ~ , ; : . < > |

Leave them off when:

• The password goes into a config file, script or command line, where quotes and backslashes are classic troublemakers.
• The system is known to reject them.
• You'll have to type the password on a phone or read it out to someone.

Avoid look-alike characters leaves out 0, O, 1, l, I and |, which are easy to confuse when you read or type a password. Every password contains at least one character of each type you turn on.

If a site rejects a password, untick the character type it doesn't accept and generate a new one. That's better than editing the password by hand.

Using generated passwords safely

Use a password manager, and a different password everywhere. Reusing passwords is how one breach turns into many: attackers try leaked email and password pairs on other sites automatically. A random password you only use once has nothing to leak to anywhere else.

Watch the clipboard. Windows clipboard history (Win+V) and clipboard sync between devices keep copies of everything you copy, passwords included. Paste the password straight into your password manager and clear the clipboard afterwards. Most password managers also have a built-in generator.

For passwords you have to remember, such as your password manager's master password or your computer login, a passphrase of random words is easier to type and remember. Six words picked at random from a standard 7,776-word list give about 77 bits.

Turn on two-factor authentication wherever it's offered. It protects the account even if the password leaks.

Longer has limits. Systems that store passwords with bcrypt ignore everything after the 72nd byte, and some sites cap password length. Somewhere between 16 and 64 characters covers almost everything.

FAQ

Are the generated passwords sent anywhere?

No. They're created in your browser, and we never see or store them.

How long should my password be?

At least 16 characters for anything stored in a password manager. Longer is better whenever the site allows it.

Do I need symbols?

They help a little, and length helps a lot more. Include symbols when a site accepts them, but don't trade length for them.

Should I change my passwords regularly?

Only when there's a reason, such as a breach, a password you shared, or one you've reused. Current NIST guidance favors long passwords over complicated composition rules and advises against forcing routine password changes.

How strong is a password I already use?

Check it with the Password Strength Test, or calculate its entropy with the Password Entropy Calculator.

I need a key for an app, not a login password.

For things like APP_KEY values, JWT secrets and API tokens, use the Random Secret Key Generator.