A strong password and passphrase generator

Frequently asked questions

How random are the generated passwords?

Passwords are generated using the Web Crypto API's cryptographically secure random number generator (crypto.getRandomValues), not Math.random(), so results are unpredictable and suitable for real account security.

Is my password sent to a server?

No. Every password is generated and displayed entirely in your browser. Nothing is ever transmitted, logged, or stored — only your generator settings (length, character types and rules) are saved locally so they're remembered next time. A password you check is never saved either.

What does "exclude ambiguous characters" do?

It removes characters that are easily confused with one another in many fonts — i, l, 1, L, I, o, O, 0 and | — which is useful if you'll need to type or read the password aloud. You can also list any characters a site refuses under “Never use these characters”, and choose exactly which symbols to use.

How is password strength calculated?

For a generated password it isn't an estimate: the tool counts exactly how many different passwords your settings can produce — including the effect of rules like “at least one of each type” — and every one of them is equally likely, so the strength in bits is log2 of that count. The crack times are the average time to find it at 10 guesses a second (a website) and 10 billion a second (a stolen password file). A password you type into the checker is scored by zxcvbn, which looks for words, names, keyboard patterns and dates the way an attacker would.

What is a passphrase?

A few random words, like Gravy-Unlocked-Skater-Tidal-Pushing-Recycled. Passphrase mode picks them from the EFF's list of 7,776 easy-to-spell words, so each word adds about 12.9 bits: six words is about 77 bits, as strong as a 12-character random password and far easier to type and remember. You choose the number of words, the separator, capitals and an optional digit.

Can I check a password I already use?

Yes — open “Check”. It estimates how quickly your password could be guessed and points out common words, names, keyboard runs and dates in it. The check runs in your browser; nothing you type is saved or sent.

Can I make many passwords at once?

Yes. “Make many at once” creates 10 to 500 with your settings, to copy together or download as a .txt or CSV file. Any password can also be opened in the QR Code Generator, to get it onto a phone by scanning.

How long should my password be?

For most accounts, 16 characters or more with all character types enabled gives a very strong password. Use the maximum length your account supports for your most sensitive accounts.

Is the Password Generator really free?

It is. No sign-up, no payment details, no expiry date, and no upgrade prompt hiding the useful parts. Every length and character option is available, and there's no cap on how many passwords you generate.

Do I have to create an account first?

No. There's no account system at all, so there's nothing to sign up for and nothing to install. Open the page and a fresh password has already been generated for you.