Password Generator
Create strong random passwords, easy-to-type passphrases and PINs with secure randomness – see how long each would take to crack, and check any password against known breaches.
- Cryptographically secure
- Passwords, passphrases, PINs
- Strength and breach check
- Never sent anywhere
Generated on your device with secure randomness. Nothing is saved or sent.
Check a password’s strength
Type any password to estimate its strength. It stays in your browser.
The breach check sends only the first 5 characters of your password’s SHA-1 hash to Have I Been Pwned – never the password itself.
How to create a strong password
- Pick a typePassword for random characters, Passphrase for words that are easier to remember and type, or PIN for numbers only.
- Set the optionsChoose the length and which characters to use. A new password appears instantly – press Generate for another, or Ctrl+Space.
- Copy and store it safelyClick the password to copy it, then save it in a password manager. Need many? Generate up to 500 at once.
How strong is strong enough?
| Example | Entropy | Offline fast-hash attack |
|---|---|---|
| 8 random letters + digits | ≈ 48 bits | About 18 minutes |
| 12 random characters, all types | ≈ 76 bits | About 10,000 years |
| 16 random characters, all types | ≈ 102 bits | Longer than the age of the universe |
| 5-word passphrase | ≈ 50 bits | About 2 hours – fine online, add words for offline safety |
| 7-word passphrase | ≈ 71 bits | About 300 years |
Good password habits
- Use a password manager so every account can have its own long random password.
- Turn on two-factor authentication for email, banking and social media – it protects you even if a password leaks.
- Never reuse passwords. Breached passwords are tried on other sites within hours.
- Change a password straight away if a service tells you it was breached, or if the breach check above finds it.
Frequently asked questions
Are these passwords really random?
Yes. They come from your browser’s cryptographically secure random number generator (crypto.getRandomValues), with rejection sampling so every character is equally likely. They’re generated on your device and never sent anywhere.
How long should my password be?
At least 12–16 random characters for everyday accounts, and 20 or more for your password manager or email. For passphrases, 5–6 random words is strong. Length matters more than adding symbols.
What is a passphrase?
Several random words joined together, like “Maple-Canyon-Tiger-Velvet-Ocean”. Five words from our list give about 50 bits of entropy – strong against online attacks and much easier to type and remember than random characters. Use six or more for very important accounts.
What does entropy mean?
Entropy (in bits) measures how many guesses an attacker would need: each extra bit doubles the work. Around 60 bits is strong for most accounts; 80+ bits is very strong. It assumes the attacker knows how the password was generated.
How is “time to crack” worked out?
It’s the average time to guess the password by trying every possibility at the given speed. Fast-hash offline attacks are the worst case; slow hashes such as bcrypt and rate-limited online logins are much slower. Real attacks vary, so treat it as a guide.
Is the breach check safe?
It only runs when you press the button. Your password is hashed with SHA-1 on your device and only the first 5 characters of that hash are sent to the Have I Been Pwned service, which returns hundreds of matching hashes. Your password and full hash never leave your browser.
Why exclude ambiguous characters?
Characters like l, 1, I, O and 0 look alike in many fonts. Excluding them helps if you’ll need to read or type the password by hand, at a small cost in strength.
Should I use the same password on several sites?
No. If one site is breached, attackers try the same email and password everywhere. Use a different password for every account and let a password manager remember them.
Related tools
Last updated: