Password Generator

What makes a password strong

A strong password is long, random and unique. Length matters most: every extra character multiplies the number of guesses an attacker needs. Randomness matters because attackers do not guess letter by letter; they try leaked passwords, dictionary words, names, dates and common patterns like Summer2026! first. A truly random password has no pattern to exploit.

The strength meter shows entropy in bits, the standard measure of how unpredictable a password is. Each bit doubles the number of possibilities:

For online accounts protected by rate limits, 60 bits is plenty. For a password manager master password, Wi-Fi keys and anything that could be attacked offline, aim for 80 bits or more.

How this password generator works

Passwords are created by your browser's crypto.getRandomValues() function, the same cryptographically secure random number generator used for encryption keys. The generator uses rejection sampling so every character is exactly equally likely, with no bias towards some letters. Nothing is generated on our server and nothing is sent over the network, so nobody but you ever sees the passwords.

• At least one of each guarantees every selected character type appears, which some sites require, by placing one of each at random positions.
• No look-alikes removes characters that are easy to confuse, like 0 and O, or 1, l and I. Useful for passwords you will read out or type from paper.
• Symbols to use and Never use these characters let you match a website's password rules exactly.

Passphrases and PINs

A passphrase is several random words joined together, like Maple-Comet-Harbor42-Velvet. It is much easier to remember and type than random characters, and with enough words it is just as strong. This generator picks words at random from a list of almost 600 short, common English words, so each word adds a little over 9 bits of entropy. Four words with a number is fair, six or more words is strong. Words are chosen by the computer, not by you, which is what makes it secure. Phrases people choose themselves, like song lyrics, are easy to guess.

A PIN is digits only. Use at least 6 digits where allowed, and never your birthday, phone number or a pattern like 123456 or 112233.

Password best practice

• Use a different password for every account. When one site is breached, attackers try the same email and password everywhere else.
• Use a password manager such as Bitwarden, 1Password, KeePass, or the one built into your browser or phone, so you only remember one strong passphrase.
• Turn on two-factor authentication, ideally with an authenticator app or passkey, for email, banking and social accounts.
• Do not change strong passwords on a schedule. Current NIST guidance says to change them only if there is a sign of compromise.
• Bulk passwords for new staff or customer accounts should be single-use: make users set their own on first login.

Developers storing passwords should never save them in plain text. Hash them with bcrypt or Argon2, which you can test with the hash generator. For random identifiers rather than secrets, use the UUID generator.

Generating passwords for teams and systems

Need passwords for many accounts at once, such as new staff, classroom accounts, Wi-Fi vouchers or test users? Set How many to the number you need and download the list. Each password is generated independently, so knowing one tells you nothing about the others.

For temporary passwords, use the No look-alikes option so people can type them without confusion, deliver each one through a separate channel, and force a change at first login. For system secrets such as API keys, database passwords and session secrets, prefer 32 to 64 random characters with letters and digits only, which avoids escaping problems in configuration files and URLs.

Password Generator: frequently asked questions