Password Generator

This generates a strong random password in your browser, using your device's own cryptographic randomness, and never sends or stores it. Most password generators show a coloured bar that says Strong. The bar means almost nothing: it is usually scoring whether the string has a capital and a digit, which is exactly why P@ssw0rd1 rates well and is among the first things any attacker tries. What actually matters is entropy — how many equally likely passwords the generator could have produced — and that is a number we can state exactly, because we chose the alphabet and the length ourselves. So this page gives you a secure random password and tells you what it is worth in bits, along with how long it would take to crack under a stated assumption rather than a flattering one.

How to use it

1. Choose random characters for maximum strength per keystroke, or words if you will have to type it on a phone or read it off a screen.
2. Set the length. Length does more for strength than any other setting — adding characters beats adding symbols.
3. Each character is drawn from your browser's cryptographic random number generator, one at a time, with no bias toward any part of the alphabet.
4. Read the entropy figure. Anything under 60 bits belongs on an account you would not mind losing; 80 and above is right for email, banking and your password manager.

Examples

• A 20-character password for a bank login, with the strength stated in bits rather than as a colour
• A six-word passphrase that can be read off one screen and typed on a phone

Frequently asked questions

What makes a password strong?

Being drawn at random from a large set of possibilities, and nothing else. Length matters most: adding one character to a random password multiplies the work an attacker faces by the size of the alphabet, while adding a symbol to a short one barely moves the number. What does not help is the thing most sites ask for — a capital, a digit and a punctuation mark bolted onto a word you already knew. Those rules produce passwords that look complicated and sit near the top of every cracking list, because everyone follows the same rules in the same way.

What does the bits number mean?

It is the base-2 logarithm of how many passwords this generator could have produced with your settings. Each extra bit doubles that number. Forty bits is roughly a trillion possibilities, which sounds enormous and falls to a determined attacker in seconds; eighty bits is beyond any current attack. The crack time shown alongside assumes one hundred billion guesses a second — about what a serious GPU rig manages against a fast hash, and far more than any online login would ever permit. It is a deliberately pessimistic figure, because a number that flattered the password would be the same dishonesty as the coloured bar.

Are words really as safe as random characters?

They can be, if you use enough of them, and the number on the page tells you whether you have. Our list holds exactly 1,024 words, so each word you add is worth exactly ten bits. Six words plus two digits comes to 67 bits, which is solid for most accounts; four words is 46 bits, which is not. The words being ordinary is not a weakness — the strength comes from how many combinations exist, not from the words being obscure, and an obscure word you cannot remember or type defeats the entire purpose of choosing words in the first place.

Where does the randomness come from?

From your browser's cryptographic random number generator, the same facility used to generate keys for encrypted connections. It is not Math.random, which is fast, predictable by design, and completely unsuitable for anything anyone will log in with. Each character is also selected by rejection sampling rather than a modulo, which removes a small bias toward the earlier characters in the alphabet — a minor flaw, but an avoidable one, and avoidable flaws in a password generator are not worth keeping.

Is the password sent anywhere, or saved?

No. It is generated in your browser and it never leaves the page — not to us, not to anyone, and it is not written to storage, history or a log. Close the tab and it is gone. This is the one tool where that guarantee has to be absolute: a password generator that transmitted its output would be handing an attacker a list of every password it had ever made, indexed by the people who asked for them.