Password generator

Make a strong random password, or a passphrase of random words that's easier to type and remember. Choose the length and characters and see how strong it is. It's made by your own browser's secure random number generator, and never leaves your device.

How this generator works

Every character or word is picked by your browser's cryptographically secure random number generator (crypto.getRandomValues), the same source browsers use for encryption keys. It isn't Math.random, which is predictable. Each pick is unbiased: random numbers that would favour some characters over others are thrown away and drawn again.

• Passwords are drawn from the character sets you tick. When you tick more than one set, the password is guaranteed to include at least one of each, since many sites insist on that.
• Passphrases are words drawn at random from a list of 1,296 short, common English words (the EFF short word list, changed to British spellings). Each word adds about 10.3 bits.
• Entropy is how many guesses it would take to be sure of finding it, as a power of 2. 16 characters from all four sets is about 103 bits, so 2¹⁰³ possibilities.
• Time to crack assumes an attacker who knows exactly how it was made and tries 100 billion guesses a second, about what a rig of graphics cards manages against a fast password hash. It's the average time, half of the full search. Against a website's login, which limits attempts, it would take far longer.

The page runs entirely in your browser. Nothing you make or choose is stored, logged or sent, not even to this site, so you can disconnect from the internet after the page loads and it still works.

How strong is strong enough?

For most accounts kept in a password manager, a random 16-character password is plenty. For the few you type by hand, like the password manager itself or your computer, a passphrase of 6 or more words is strong and much easier to type.

Tips for safer passwords

• Use a different password for every site. When one site leaks its passwords, attackers try them everywhere else. A password manager remembers them all for you.
• Turn on two-step verification (also called two-factor or 2FA) for email, banking and social media. It stops most account takeovers even if a password leaks.
• Your email password matters most, because it can reset every other account. Make it a long passphrase you use nowhere else.
• Don't change a strong password just because time has passed. The UK's National Cyber Security Centre advises changing it when you think it may have leaked, not on a schedule. Its "three random words" advice is where passphrases come from.
• Running a website or email domain? The DMARC record generator and email DNS checker help stop others sending email as you.

Frequently asked questions

Is this password generator safe to use?

Yes. The password is made by your browser on your device using its secure random number generator. It isn't sent to this site or anyone else, and nothing is saved. You can check by turning off your internet after the page has loaded: it still works.

How long should a password be?

At least 12 characters, and 16 or more for important accounts. Length adds strength faster than symbols do: each extra character multiplies the guesses needed by the number of possible characters.

What is a passphrase?

A password made of several random words, like Tulip-Oasis-Cider7-Lunar-Plaza. Random words are easy to remember and type, and five or more chosen by a computer are very hard to guess. Words you pick yourself are far weaker, because people pick predictable ones.

What are look-alike characters?

Characters that are easy to confuse when reading or typing a password, like zero and capital O, or one, small L and capital I. Leaving them out makes a password slightly weaker per character, so the generator shows the strength with that taken into account.

Why do some sites reject symbols?

Some older systems only accept certain symbols. If a site rejects the password, untick symbols and add a few more characters instead to keep it just as strong.

What does entropy mean?

It measures how unpredictable a password is, in bits. Each extra bit doubles the number of guesses needed. It only applies to passwords made randomly, like these; a password you make up yourself is weaker than its length suggests.

Does it save or send my password?

No. Nothing is stored, logged or sent anywhere. Once you leave or reload the page, the password is gone, so copy it into your password manager first.