Password generator
Strong random passwords, generated in your browser. Set the options, then generate.
— —
Pick at least one character type.
Options changed — generate again to apply.
Loading the word list…
Want words you can remember? xkcd and diceware passphrases →
Questions
Is the password sent anywhere?
No. Passwords are generated inside your browser using its built-in cryptographic random number generator, the same one used for encryption keys. The page makes no network request when you click Generate, the server never sees the result, and nothing is logged. You can confirm this yourself in your browser’s developer tools under the Network tab.
Does it remember the passwords it makes?
No. It remembers your settings, such as the length, which character types you ticked and your passphrase options, in your browser’s local storage so they are the same next time. The generated password itself is never stored, never appears in your browser history and is gone when you leave the page.
What do the “bits” mean?
Entropy, measured in bits, is how many equally likely passwords your settings could have produced. Each extra bit doubles the number of guesses an attacker would need. A 20-character password using all four character types is about 127 bits. The label next to the number is a plain-English reading of it: under 50 bits is weak, 50 to 74 fair, 75 to 99 strong, and 100 or more very strong.
Should I use a passphrase or a random password?
A passphrase is several random words from the EFF long word list of 7,776 words, worth about 12.9 bits each, so six words is roughly 78 bits and easy to type or remember. Use a passphrase for anything you type by hand, such as a laptop login or Wi-Fi. Use random characters for accounts a password manager fills in for you, where length and symbols cost you nothing.
What does “avoid look-alikes” do?
It removes the characters that are easy to confuse when read aloud or copied from paper: capital I, lowercase l, the digit 1, the vertical bar, capital O, the digit 0 and lowercase o. Turn it on for a password you will read to someone or type from a printout, and leave it off when a password manager is doing the typing.