How to generate a strong password
- Choose a mode: Characters for a random string, Words for a passphrase like “Luna7!Forest#42River-Green9”.
- Adjust the options. Every change creates a new password, and the strength is recalculated as you go.
- Click Copy and paste it where you need it, ideally into a password manager.
Characters or words: which should you pick?
A random string of characters packs the most strength into the fewest characters, so it’s the better choice whenever a password manager types it for you and you never have to read it out.
A passphrase is built from random words, so it survives being read aloud, copied from a screen or typed on a phone or a games console. It needs more characters to reach the same strength, but it’s far easier to handle. Both modes are equally random: only the shape of the result changes.
Either way, a password is only as safe as it is unique: reuse is what turns one site’s breach into a problem on all your other accounts.
How the passwords are generated
Every character, word and position is picked with your browser’s cryptographic random number generator (Web Crypto, crypto.getRandomValues), the same source used to create encryption keys. Unlike Math.random(), which many websites use, it can’t be predicted.
In Characters mode, each type you select appears at least once, and every possible password is equally likely: the generator draws from all the characters together and discards any result that misses a type, instead of forcing characters into fixed positions.
In Words mode, the words come from a dictionary in the language of the page. Numbers and symbols are not tacked onto the end: both their values and their positions are drawn at random, so they can land between words or right next to one. Where nothing was inserted, a hyphen keeps the words apart, so the result stays readable.
Why symbols alone don’t make a password safe
Replacing letters with lookalike symbols — “p@ssw0rd” instead of “password” — adds almost nothing: those swaps are the first thing cracking software tries. Rules that demand one capital, one digit and one symbol tend to produce the same predictable shapes, which is why this generator never does those substitutions.
What actually counts is how many equally likely results the generator could have produced. Four extra random characters beat any amount of clever-looking punctuation on a password you invented yourself.
What the strength bar measures
Strength is shown as entropy, in bits: how many equally likely passwords these settings could produce, written as a power of two. 60 bits means about 2⁶⁰ possibilities, over a billion billion. Each extra bit doubles the number of guesses an attacker would need.
As a guide, under 50 bits is weak, 50 to 69 is fair, 70 to 99 is strong and 100 or more is very strong. A 16-character password with all four types has about 103 bits; four random words with two digits and two symbols, about 81.
The number is exact for what this page generates, not a guess about your habits: it counts the choices the generator actually made. We don’t show “time to crack” estimates, because they depend on how each site stores passwords and on the attacker’s hardware, which nobody can know. Entropy also only applies to random passwords: one you invent yourself is much weaker than its length suggests.
Good habits with passwords
- Use a different password for every account, so a breach on one site doesn’t expose the others.
- Keep them in a password manager instead of memorizing or reusing them.
- Turn on two-step verification wherever it’s available.
- Change a password when a service reports a breach, not on a fixed schedule.
Your passwords are never sent or stored
The password is created in your browser, on your device. It is never sent to our servers, logged or saved: when you refresh or close the page, it’s gone. The dictionary for the Words mode is a file on this site, downloaded once and used locally.
Frequently asked questions
How long should my password be?
In Characters mode, 16 characters with letters, numbers and symbols is plenty for most accounts, and 20 or more for the master password of a password manager. In Words mode, four words with a couple of numbers and symbols are about as strong as a 12-character random password; five or six words are better for anything important.
Are passphrases weaker than random passwords?
Not at the same number of bits. A passphrase is longer in characters because each word adds about 11 to 13 bits, while a random character adds about 6.5. The strength bar shows the real figure for both modes, so you can compare them directly.
Where do the words come from?
From a dictionary that matches the language of the page, bundled with the site: 7,772 English words from the EFF large wordlist, or 2,131 Spanish words curated for this tool. Both avoid offensive words, and no word is the beginning of another, which makes them easier to read and type.
Can I change the language of the words?
The words follow the language of the page. Switch the site to Spanish and this tool will generate Spanish passphrases.
Is it safe to generate a password on a website?
Here it is: the password is created in your browser with Web Crypto and never leaves your device. Once the page has loaded, it keeps generating passwords even without an internet connection.
What are ambiguous characters?
Characters that look alike in many fonts: uppercase I, lowercase l, the number 1, the vertical bar |, uppercase O, lowercase o and the number 0. Leaving them out helps when a password has to be read or typed by hand. It lowers the strength slightly, and the bar shows by how much.
Which symbols are used?
! # $ % & ( ) * + , - . / : ; < = > ? @ [ ] ^ _ { | } ~. Quotes, backslashes, backticks and spaces are left out because they cause problems in many forms and systems. In Words mode the hyphen is reserved as the word separator. If a site rejects a symbol, turn symbols off and add length instead.
Can I change the password by hand?
Yes. The pencil button next to the eye turns the result into a text field, so you can fix a character a site won’t accept. Copy then copies what you see. Once you change anything, the strength reads “Customized password”, because the figure the generator shows counts its own random choices and says nothing about a password a person typed. Generating a new one discards the edit.
Can I get the same password again?
No. Passwords are random and not saved anywhere, so copy yours before generating a new one or leaving the page.
English passphrases use the EFF Large Wordlist for Passphrases by Joseph Bonneau (Electronic Frontier Foundation), licensed CC BY 3.0 US; the dice numbers and four hyphenated entries were removed. The Spanish wordlist was curated for Toolerama and is released into the public domain (CC0 1.0).