Password Generator

How to create a strong password

1. Pick a style, or leave it on Strong. A new password is made straight away.
2. Change the length with the slider. Longer is stronger, and 16 characters or more is a good habit.
3. Turn character types on or off, and leave out look-alike characters if you will type the password by hand.
4. Click Copy, then paste the password into the website and into your password manager.

What makes a password strong?

• Length matters most. Each extra character multiplies the number of guesses an attacker needs. A random 16-character password is far stronger than a clever 8-character one.
• Randomness beats cleverness. Passwords people invent follow patterns, such as names, dates and common substitutions like @ for a. Attackers try those first. A random password has no pattern to find.
• Use a different password for every account. If one website is breached, the others stay safe.

How is the strength measured?

The strength bar shows entropy in bits, which counts how many equally likely passwords there could be with your settings. Each extra bit doubles the number of guesses needed. As a rough guide, under 40 bits is weak, 60 to 80 bits is good for most accounts, and 100 bits or more is very strong. It assumes the password is truly random, so it applies to generated passwords and not to ones you make up yourself.

Is it safe and private?

Yes. Passwords are created entirely in your web browser, using the secure random number generator built into your device, and a method that avoids favoring some characters over others. They are never sent over the internet, saved or logged by this website. This tool needs no outside libraries.

Tips for using passwords safely

• Store your passwords in a trusted password manager, so you do not need to remember them or write them down.
• Turn on two-step verification wherever it is offered. It protects an account even if a password leaks.
• Do not reuse a generated password on another site, and never share it by email or chat.
• If a site limits which symbols it accepts, edit the Symbols list, or turn symbols off and make the password a little longer instead.
• PINs are short, so they rely on the device or service limiting how many guesses are allowed.

Building something that stores passwords? Never keep them in plain text. Use a slow password hashing method such as bcrypt, scrypt or Argon2. To check file fingerprints instead, try our SHA256 Hash Generator.