Generate a strong password
Generated right here in your browser with crypto.getRandomValues. Your password is never sent, saved or logged.
How to generate a strong password
Choose between a character password and a word passphrase. For characters, set the length from 8 to 128 and tick the types you want: uppercase, lowercase, numbers, and symbols. You can also exclude look-alike characters such as i, l, 1, L, o, 0, and O, which helps when you have to type the password by hand.
The characters come from your browser's secure random number generator (the same one used for cryptography), not from a predictable formula. The password is created on your device and is never sent, saved, or logged. Press the button again for a new one, and copy it straight into your password manager.
What entropy in bits means
Entropy counts how many guesses an attacker would need on average. Each extra bit doubles the number of possibilities. The tool estimates it from the length and the size of the pool of characters you picked.
| Entropy | Strength label in the tool | Example |
|---|---|---|
| Under 36 bits | Very weak | 4 passphrase words |
| 36 to 59 bits | Weak | 6 passphrase words |
| 60 to 79 bits | Fair | 12 random characters from 62 |
| 80 to 99 bits | Strong | 16 random characters from 62 |
| 100 bits or more | Very strong | 20 random characters from 62 |
Passphrases: easy to type, easy to remember
A passphrase strings together random common words, like "river-stone-lamp-cloud". The built-in list has 393 short lowercase words, so each word adds about 8.6 bits (log2 of 393). Words are chosen at random, not from a quote or a song.
| Words | Entropy | Note |
|---|---|---|
| 4 | About 34.5 bits | Too weak for anything important |
| 6 | About 51.7 bits | Fine for low-risk accounts |
| 8 | About 69 bits | Close to the 70-bit mark the tool aims for |
| 10 | About 86 bits | Long, but still easy to type on a phone |
You can pick the separator (hyphen, space, period, or none), capitalize each word, and add a two-digit number, which adds about 6.6 bits. A passphrase works well for a password manager's master password or a laptop login, where you have to type it from memory.
Good password habits
- Use a different password for every account, so one leak does not open the others.
- Store them in a password manager and turn on two-factor authentication where it is offered.
- Prefer length over tricks. A long random password beats a short one with swapped-in symbols.
- Change a password when a site reports a breach, not on a fixed schedule.
Sizing text for a form field or a limit? The word counter counts characters. Need random numbers for a game or a drawing? Use the random picker, which is meant for decisions, not for secrets.
Frequently asked questions
How do I generate a strong random password?
Set a length of at least 16, keep all four character types on, and click generate. The result is created in your browser and is never sent anywhere.
How long should a password be?
Use 16 characters or more for important accounts. A random password of 16 characters from letters and digits carries about 95 bits of entropy.
What is a passphrase?
A passphrase is a password made of several random words, such as "river-stone-lamp-cloud". Eight random words give about 69 bits and are easier to remember than a string of symbols.
What does entropy in bits mean for a password?
Entropy measures how unpredictable a password is. Every extra bit doubles the guesses needed, so 80 bits is a billion times harder to guess than 50.
Is a random password generator safe to use?
Yes, when it runs in your browser and uses a secure random source. This one never sends, saves, or logs what it generates.
Should I exclude look-alike characters?
Only when you have to type the password by hand. Dropping characters like l, 1, O, and 0 shrinks the pool slightly, so add a few characters of length to make up for it.
Sources and method
- NIST, Digital Identity Guidelines: Authentication and Lifecycle Management (SP 800-63B)
- MDN Web Docs, Crypto.getRandomValues()