Password Generator

How to make a password you can trust

The math behind "strong"

Password strength is measured in bits of entropy: how many guesses an attacker needs, expressed as a power of two. Each character drawn from a 94-symbol set adds about 6.5 bits, so a random 16-character password carries roughly 105 bits — far beyond what offline cracking rigs can search. The insight most people miss is that length is exponential and complexity is linear: adding four characters helps astronomically more than swapping an a for an @, which cracking dictionaries try anyway. That's why the strength meter here rewards longer passwords so steeply, and why the crack-time estimate collapses from "centuries" to "hours" as length drops.

Random string or passphrase?

Both modes produce serious security; they differ in who has to remember the result. For the hundreds of credentials that live inside a password manager, use random mode at 16–24 characters — no human ever types them. For the handful of secrets you must carry in your head (the manager's master password, a disk-encryption phrase, your main email), use passphrase mode: four to six random words like river-copper-lantern-42 are dramatically easier to memorize and type, while drawing enough entropy from the word list to resist guessing. The critical property in both cases is that the words and characters come from your browser's crypto.getRandomValues — genuine randomness, not a human "thinking of something random," which is the weakest generator there is.

Habits that matter more than symbols

One password per site is the rule that survives breaches: when a leaked database surfaces, reused credentials are what turn one compromised forum into a compromised inbox. Pair unique passwords with a manager so uniqueness costs nothing, turn on two-factor authentication where offered, and treat "password expired, add a 2 at the end" rotations with suspicion — modern guidance favors long, unique and unchanged over frequently mutated. The bulk generator exists for exactly the unglamorous jobs: provisioning a batch of accounts, seeding test users, or rotating a family's worth of router and streaming logins in one sitting.

Step-by-step: from blank field to saved credential

A password is generated the moment the page loads, so the quickest path is Copy and paste into your password manager. To tune it, choose a mode first. In Random password the Options panel shows a Length slider (4–64, default 18) and five toggles: lowercase, uppercase, numbers, symbols and Exclude look-alikes, which drops I, l, 1, O and 0. In Passphrase you get a word-count slider (2–8, default 4), a separator switch (dash, underscore, dot, space or none) and toggles for capitalizing each word and appending a number. Every change regenerates instantly, and the bar beneath the result re-rates it: Weak under 40 bits, Fair to 60, Strong to 80, Very strong above — alongside a crack-time estimate. Press Regenerate until you get one you like (for passphrases, until the words are ones you can picture), copy it, store it, and only then close the tab; nothing is kept after that. For many credentials at once, set a count in Bulk generate (up to 50), click Generate list and Copy all.

Real-world use cases

• A home Wi-Fi key guests will type. Random mode, 16 characters, symbols off, look-alikes excluded. It stays well above 80 bits yet can be read from a card on the fridge without the O-versus-0 guessing game. Pair it with a Wi-Fi QR code so most guests never type it.
• The password-manager master password. Passphrase mode, six words, dash separator, capitalization on. Around 75–80 bits from the word list alone, and the only secret you will type from memory every day.
• A legacy site capped at 12 characters. Turn every character class on, set Length to the cap, and accept that this one credential is weaker than the rest — which is exactly why it must be unique and, if possible, protected with two-factor authentication.
• Provisioning twenty test accounts. Bulk generate 20 random passwords, copy the list into the seeding script, and delete it from the clipboard history afterwards.

Common mistakes and how to avoid them

Most failures happen after generation, not during it. Editing a random password "to make it memorable" — swapping in a pet's name or a birth year — replaces high-entropy characters with guessable ones; if you need memorability, switch to passphrase mode instead of hand-editing. Storing a generated password in a notes app, a chat message or a screenshot defeats its purpose, because those are synced and searchable; a manager's vault is the only sensible home. Reading the crack-time estimate as a guarantee is another trap: it models an offline attacker guessing at a fixed rate, and a site that stores passwords badly or leaks them in plain text makes the estimate irrelevant — uniqueness per site is what limits that damage. Finally, generating on a shared or public computer leaves the value in the clipboard for the next user; clear the clipboard or, better, generate on your own device.

Further reading

For the math behind the strength meter, read password entropy explained; to share a Wi-Fi key without typing it, see how QR codes work. You can also browse all guides.

Frequently asked questions