Strong passwords, made on your device.

Random passwords and easy-to-type passphrases, made with your browser’s secure random number generator. Nothing is sent, saved or logged.

  • Free, no sign-up
  • Made on your device
  • Works offline
Characters are best in a password manager. A passphrase is easier to type and remember.
Use these characters
Quick picks
More to choose from

    How to make a strong password

    1. Pick a length

      Sixteen characters is a good floor. Use twenty or more for email, banking and your password manager.

    2. Choose the characters

      Keep letters, digits and symbols on unless a site refuses some of them.

    3. Copy it into your manager

      Press Copy and save it in a password manager. There is no need to remember it.

    A password is only strong if it is random, and people are poor at being random. This generator picks every character with crypto.getRandomValues, the secure source built into your browser, and guarantees at least one character from each set you switch on. The password exists only on this page.

    What it does

    • Length from 4 to 128, with sliders and a number box.
    • Lowercase, uppercase, digits and symbols, each optional.
    • Leaves out look-alike characters like l, 1, I, O and 0 when you want to read or type it.
    • Shows strength as bits of randomness and a rough guessing time.
    • Passphrases of 3 to 12 random words from the EFF word list, with your choice of separator, capitals and a number.
    • Digits and symbols are coloured, so a password is easy to read back and type.
    • Quick picks for a strong password, an easy-to-read one and a numeric PIN, plus a few spare ones to choose from. Your settings are remembered on this device.

    Password Generator: questions and answers

    Is it safe to use an online password generator?

    Only if it makes the password on your device, as this one does. Nothing here is sent over the network, and you can check that in your browser’s developer tools or by turning off your connection after the page loads.

    How long should a password be?

    Sixteen characters or more for most accounts, twenty or more for email, banking and the master password of a password manager. Length adds more strength than extra symbols do.

    What do bits of randomness mean?

    Each bit doubles the number of guesses an attacker needs. Around 80 bits is out of reach of today’s attacks on a properly stored password, and 100 bits or more is far beyond it.

    How accurate is the guessing time?

    It is a rough picture. It assumes ten billion guesses a second against a fast hash, which is a harsh case. Sites that store passwords well are far slower to attack, and leaked databases are the reason a long random password matters.

    Should I memorise the password?

    No. Keep it in a password manager and memorise only the master password. Use a different generated password for every account.

    Why leave out look-alike characters?

    Characters like l, 1, I, O and 0 are easy to mix up when you read a password off a screen or a printout. Leaving them out makes it easier to type, and costs very little strength.

    Is a passphrase better than a random password?

    For a password manager, random characters pack the most strength into the fewest characters. For anything you have to type or remember, such as your computer login or the manager’s own master password, a passphrase of five or more random words is just as hard to guess and far easier to type. Five words from the 7,776-word EFF list give about 65 bits of randomness; six give about 78.

    More free tools

    File Hash CheckerMD5, SHA-1, SHA-256 and SHA-512Open tool →Photo Metadata RemoverSee and remove GPS and camera dataOpen tool →Online NotepadAutosaving notes with Markdown previewOpen tool →
    Available for full-time and freelance

    Need a custom tool, site or store?

    I scope, design and build tools, websites and Shopify stores for teams in India and abroad. Send a short brief and I will reply within 48 hours.