Password and Passphrase Generator
Text & Dev ToolsRandom passwords or word passphrases, made in your browser, with their exact strength in bits.
What you type never leaves this device. Everything here runs in your browser — your text is never uploaded, stored or seen by us. Open your network tab and check.
Up to 128 can be typed in the box.
Generating…
How this is calculated
Strength, in bits = log₂(number of passwords these settings could make) Random characters, no requirements bits = length × log₂(characters to pick from) 20 characters from all 94 → 20 × 6.55 = 131 bits Passphrase from the EFF short wordlist (1,296 words) bits = words × log₂(1,296) = words × 10.34 8 words → 82 bits Each extra bit doubles the guesses needed to be sure of finding it.
How it works
Every character, and every word, is picked at random by your browser's cryptographically secure generator, crypto.getRandomValues. Picks are made so that no character is more likely than another: the common shortcut of taking a random number modulo the number of characters makes the first few slightly more likely, so draws that would cause that are thrown away and drawn again.
Strength is measured in bits: log₂ of how many passwords the same settings could have produced. Because the password is random, that number is its real strength — an attacker who knows exactly how it was made still has to try, on average, half of them. A password a person makes up has much less strength than its length suggests, because people choose predictably.
"At least one of each kind" is done by drawing whole passwords and drawing again if one misses a kind, which keeps every qualifying password equally likely. The page counts qualifying passwords exactly, so the strength shown is for what it actually generates. At normal lengths the requirement costs a fraction of a bit.
Length matters more than symbols. NIST's password guidance, SP 800-63B, was revised in August 2025: a password that is the only protection on an account must be at least 15 characters, sites should accept at least 64, and they must not demand mixtures of character types or force regular changes. A passphrase — several random words — reaches that length while staying possible to type and remember. Its words come from the Electronic Frontier Foundation's short wordlist, 1,296 words of three to five letters chosen to be memorable and distinct.
Worked example
Which is stronger: 12 characters with symbols, 16 letters and digits, or 8 random words?
- 12 characters from all 94 12 × log₂ 94 = 78 bits
- 16 letters and digits (62) 16 × log₂ 62 = 95 bits
- 8 words from 1,296 8 × log₂ 1,296 = 82 bits
- Dropping symbols but adding 4 characters gains 16.6 bits:
- 62¹⁶ ÷ 94¹² ≈ 100,000 times as many passwords to try.
Sixteen letters and digits beat twelve characters with symbols; length does more than variety
Source
How to use it
- Choose Random characters for a password a password manager will remember for you, or Passphrase for one you need to type or remember yourself.
- Set the length or the number of words. Strength and length update as you change them.
- If a site refuses symbols, untick Symbols; the page says how long to make the password to stay as strong.
- Copy it straight into the site or your password manager. Generate new draws another.
What this tool does not do
- The strength figure is for the password as generated. Change it by hand and the figure no longer applies.
- Nothing is saved: close or reload the page and the password is gone, so store it in a password manager first.
- A strong password does not protect an account whose site is breached and stores passwords badly, or one you reuse elsewhere. Use a different password for every site, and turn on two-factor authentication where it is offered.
- The character sets are ASCII only, and symbols exclude the space. Some sites still refuse certain symbols.
- Passphrases use English words from one list, and a digit or capitals can be added only in the ways offered.
Frequently asked questions
How long should a password be?
At least 15 characters for an account protected by a password alone — the minimum NIST SP 800-63B sets. Eight is its minimum only when a second factor, such as a code from an app, is also required. Longer is stronger; the 20-character default here gives about 130 bits.
Do I need symbols and numbers?
Not for strength — length does more. NIST now tells sites not to require a mix of character types, because people meet those rules predictably — its own example is password becoming Password1!. Some sites still insist, which is what the "at least one of each kind" option is for; it costs almost nothing.
Is a passphrase really as strong as a random password?
When the words are picked at random, yes, and the strength is easy to count: each word from the 1,296-word list adds 10.34 bits. Eight words give about 82 bits, which EFF compares to six words from its longer list. The strength does not depend on the list being secret. A phrase you think up yourself, or a line from a song, is much weaker.
Is it safe to generate a password on a website?
This one is made in your browser and never sent anywhere — you can load the page, disconnect from the internet, and it still works. The only requests the page makes once you use it are small ones recording that the tool was used, with nothing about the password. That said, a password manager's built-in generator avoids the copy-and-paste step entirely.
Should I change my passwords regularly?
Not on a schedule. NIST's guidance says sites must not force periodic changes, and must force a change only when there is evidence a password has been compromised. That is the time to change yours too: the site was breached, you shared it, or you reused it somewhere else.
What does leaving out look-alikes do?
It removes O, 0, I, l, 1 and |, which are easy to confuse when a password is read off a screen or paper and typed by hand. Each character then has fewer possibilities, so the strength figure drops a little; it is only worth it when someone will actually retype the password.
Related tools
tell us
Last updated 13 September 2026.