Password generator

How to use the password generator

A new password appears as soon as the page loads and changes whenever you adjust an option, just like the generators built into Bitwarden and 1Password. Drag the length slider anywhere from 4 to 128 characters, switch uppercase, lowercase, digits and symbols on or off, and set how many digits and symbols must appear at minimum. Every enabled type is always represented at least once, so the result passes the usual “must contain a number and a symbol” rules first time.

Some sites reject particular characters — often quotes, backslashes, spaces or angle brackets. Edit the symbol set to only the symbols the site accepts, or type characters into Never use these characters. Avoid look-alikes removes 0/O/o, I/l/1, the pipe and quote marks, which is useful when a password will be read aloud or typed from paper. Digits show in blue and symbols in orange for the same reason.

Choose PIN for a phone, card or alarm code: digits only, 4 to 12 long, with an option to skip the PINs people guess first — repeated digits, runs such as 1234 or 9876, patterns like 1212 and years such as 1990.

Need a batch, for example for new staff accounts or test users? Set How many to up to 100 and use Copy all or Download .txt. The history panel keeps the last 50 results for this tab only, masked until you tick Show.

Entropy and crack time explained

Password strength is measured in bits of entropy: the number of equally likely possibilities, expressed as a power of two. A random password of length L drawn from a pool of N characters has L × log₂(N) bits. With all four character types and the default symbol set the pool is 87 characters, worth about 6.4 bits each, so 16 characters give about 103 bits. With “no character used twice” the tool uses the exact figure for drawing without replacement, which is slightly lower.

The crack-time figure assumes an attacker who knows exactly how the password was made and can try 10 billion guesses per second — realistic for a rig of graphics cards attacking a fast, leaked hash — and shows the average time to hit it, half the keyspace.

Real sites that store passwords with slow hashes such as bcrypt or Argon2 are far harder to attack than this, so the estimate is deliberately pessimistic. It only applies to randomly generated passwords: a human-chosen password of the same length is dramatically weaker because attackers try common patterns first.

When to use a passphrase instead

A passphrase is a string of random words, such as walnut-quartz-ferry-velvet-orbit. It is the Diceware idea: each word is picked at random from a fixed list, so its strength comes from the list size, not from clever spelling. Words here come from the EFF large wordlist published by the Electronic Frontier Foundation — the same list Bitwarden uses — which has 7,776 words chosen to be memorable and easy to type. Each word is worth log₂(7,776) ≈ 12.9 bits, so five words give about 65 bits, six about 78 and seven about 90. Random capitalisation adds one bit per word, a random-digit separator about 3.3 bits per gap, and adding a digit to one word about 5.6 bits for a five-word phrase.

With no separator, words could run together ambiguously (ink + well looks like inkwell), which would make the strength figure slightly optimistic, so Title Case is used automatically to keep every word boundary visible. If the list can’t be loaded — for example when the page is opened offline from cache — a smaller built-in list is used and the strength figure drops to match; the note under the options says which list is in use. The list is © Electronic Frontier Foundation and used under the CC BY 3.0 US licence.

Passphrases are much easier to type on a phone or a TV remote and to remember, which makes them ideal for the few secrets you cannot keep in a password manager: the manager’s own master password, your computer login and disk-encryption keys. Use at least six words for those, seven for a master password. Everything else should be a long random password stored in a password manager, different for every site.

How the generator protects you

• Cryptographic randomness only. Every character and word comes from crypto.getRandomValues, the same source browsers use for encryption keys. We use rejection sampling, so no character is more likely than another (the “modulo bias” that naïve generators suffer from).
• Generated on your device, never sent. The password is created in your browser and our code never transmits it or includes it in any request. The only thing this tool fetches is the public word list, and it fetches the same file for everyone.
• Other scripts on the page. Like every page on this site, this one loads Cloudflare Web Analytics (anonymous page-view counts) and Google AdSense (advertising). Our code never passes the password to either. They run in the same page as the generator, though, so if you want no third-party code present at all, use a private window with an ad blocker, or the generator built into your password manager — the maths is the same.
• Nothing is stored. Your option choices are remembered in your browser for convenience; the passwords themselves only exist in this tab’s memory.
• Clipboard hygiene. Copied passwords are cleared after the delay you choose, but only if the clipboard still holds the password: if you copied something else in the meantime it is left alone, and if you switched to another app and the browser won’t let the page check, you get a one-click Clear clipboard now button instead. Clipboard-history features such as Windows Win+V may still keep a copy.

Setting up a guest network? Share it with a Wi-Fi QR code so nobody has to type your new key. For lottery-style numbers or a random pick from a range, use the random number generator.

Frequently asked questions