Strong password generator

How this generator works

Every character, or every word in passphrase mode, is picked with crypto.getRandomValues(), the cryptographically secure random source built into the browser and fed by your operating system. Choices are made by rejection sampling, so each possible character is exactly as likely as any other. With several character types switched on, the generator also makes sure each one appears at least once, by discarding and redrawing any password that misses a type. That keeps the result evenly random across every password that meets the rules.

The page has no server-side code and sends nothing. Once it has loaded, it works offline. The strength figure is calculated from the settings, not by looking at the result, because the true strength of a random password depends only on how many passwords the generator could have produced.

What makes a password strong

A password is strong when an attacker would have to try an enormous number of guesses to find it. That number depends on two things: the length, and how many choices there are for each position. Each extra character multiplies the work. Mixing in upper case, numbers and symbols helps, but length helps more, which is why a long password of plain words can beat a short one full of symbols.

Strength is measured in bits of entropy. Every extra bit doubles the number of guesses needed. The table shows roughly how long an offline attack would take at ten billion guesses a second, the same pessimistic assumption our password strength checker uses. That is the speed a single modern graphics card can reach against a fast, unsalted hash. Well-run services store passwords with slow hashes such as bcrypt or Argon2, which cut the rate by many thousands of times.

These figures only apply to passwords picked at random. A password a person makes up, such as a pet’s name with a year and an exclamation mark, is far weaker than its length suggests, because attackers try those patterns first.

Passphrases and the Diceware method

Passphrase mode follows Diceware, a method the American writer Arnold Reinhold published in 1995. You roll five dice to pick each word from a numbered list of 7,776 words (six to the power of five). Because every word is chosen at random, each one adds about 12.9 bits of entropy, whatever the word is. Six words give about 77 bits, more than a random 12-character password with symbols.

This page uses the Electronic Frontier Foundation’s long wordlist, published in 2016 by Joseph Bonneau, in place of Reinhold’s original list. The EFF chose common, concrete words that are easy to spell and remember and removed offensive or confusable ones. The list is released under a Creative Commons Attribution licence. The idea reached a wide audience through the 2011 xkcd comic “Password Strength”, whose example “correct horse battery staple” is now so well known that it, like any published example, should never be used.

Words are only safe when the computer picks them. People choosing their own “random” words tend to pick related ones, song lyrics or quotations, and attackers’ tools are built to try exactly those.

Which to use, and where

• Accounts in a password manager: a random password of 20 or more characters. You never type it, so there is no reason to make it shorter.
• Your password manager’s master password, your computer login or Wi-Fi: a passphrase of six or seven words. It is strong and you can type it on a phone keyboard.
• Sites with strict rules: if a site caps the length or rejects some symbols, adjust the options and keep the password as long as the site allows.

Whichever you choose, use a different password for every account. The biggest risk to most people is not guessing but reuse: when one site is breached, attackers try the same email and password everywhere else. Turn on two-factor authentication where it is offered, and use a passkey where a site supports one, since a passkey cannot be phished or reused.

Questions

Is it safe to use an online password generator?

It is safe when the password is made on your own device and never sent anywhere, which is how this page works. The page has no server-side code: the password is created by JavaScript in your browser using the operating system’s secure random number generator, and it is not logged, stored or transmitted. You can load the page, disconnect from the internet and it will keep working.

How random are the passwords?

Each character or word is chosen with crypto.getRandomValues(), the cryptographically secure random source built into every modern browser. The generator uses rejection sampling so that every character is exactly as likely as every other, and it never uses Math.random(), which is not designed for security.

How long should my password be?

For passwords kept in a password manager, use at least 16 characters; 20 costs nothing extra. For a password you have to remember and type, a passphrase of six random words is easier to handle than a 13-character jumble and is about as strong. The 2025 revision of the US NIST digital identity guidelines asks services to require at least 15 characters when a password is the only thing protecting an account.

Password or passphrase: which is better?

Neither is stronger by nature; strength comes from how many equally likely possibilities there are. A random 20-character password and an eight-word passphrase are both far beyond any realistic guessing attack. Use random characters where software fills the password in for you, and a passphrase where a human has to remember or type it, such as a password manager’s master password or a computer login.

Should I change my passwords regularly?

Not on a schedule. NIST’s guidelines tell services not to force periodic changes, because people respond by making small, predictable edits. Change a password when there is a reason to: a breach notice, a sign of misuse, or if you reused it somewhere else.

Why do some sites reject the password?

Some sites cap the length or refuse certain symbols. If a site complains, turn off symbols or shorten the password a little, and make up the difference with extra length where the site allows it.

Want to test a password you already have? The password strength checker estimates it locally. For a reminder of why account recovery matters as much as the password, read how a guessable security question exposed a celebrity’s phone in the 2005 Sidekick hack.