How to use the password generator
A new password appears as soon as the page loads and changes whenever you adjust an option, just like the generators built into Bitwarden and 1Password. Drag the length slider anywhere from 4 to 128 characters, switch uppercase, lowercase, digits and symbols on or off, and set how many digits and symbols must appear at minimum. Every enabled type is always represented at least once, so the result passes the usual “must contain a number and a symbol” rules first time.
Some sites reject particular characters — often quotes, backslashes, spaces or angle brackets. Edit the symbol set to only the symbols the site accepts, or type characters into Never use these characters. Avoid look-alikes removes 0/O/o, I/l/1, the pipe and quote marks, which is useful when a password will be read aloud or typed from paper. Digits show in blue and symbols in orange for the same reason.
Need a batch, for example for new staff accounts or test users? Set How many to up to 100 and use Copy all or Download .txt. The history panel keeps the last 50 results for this tab only, masked until you tick Show.
Entropy and crack time explained
Password strength is measured in bits of entropy: the number of equally likely possibilities, expressed as a power of two. A random password of length L drawn from a pool of N characters has L × log₂(N) bits. With all four character types the pool is about 90 characters, worth roughly 6.5 bits each, so 16 characters give around 104 bits. With “no character used twice” the tool uses the exact figure for drawing without replacement, which is slightly lower.
The crack-time figure assumes an attacker who knows exactly how the password was made and can try 10 billion guesses per second — realistic for a rig of graphics cards attacking a fast, leaked hash — and shows the average time to hit it, half the keyspace.
| Entropy | Average time at 10¹⁰/s | Verdict |
|---|---|---|
| 40 bits | under a minute | Very weak |
| 60 bits | about 1.8 years | Fair |
| 80 bits | about 1.9 million years | Strong |
| 100+ bits | longer than the universe has existed | Very strong |
Real sites that store passwords with slow hashes such as bcrypt or Argon2 are far harder to attack than this, so the estimate is deliberately pessimistic. It only applies to randomly generated passwords: a human-chosen password of the same length is dramatically weaker because attackers try common patterns first.
When to use a passphrase instead
A passphrase is a string of random words, such as walnut-quartz-ferry-velvet-orbit. It is the Diceware idea: each word is picked at random from a fixed list, so its strength comes from the list size, not from clever spelling. Our built-in list has more than 1,400 common English words, worth about 10.5 bits each, so five words give roughly 52 bits and seven give about 73. Random capitalisation adds one bit per word and a random-digit separator about 3.3 bits per gap.
Passphrases are much easier to type on a phone or a TV remote and to remember, which makes them ideal for the few secrets you cannot keep in a password manager: the manager’s own master password, your computer login and disk-encryption keys. For those, use at least six or seven words. Everything else should be a long random password stored in a password manager, different for every site.
How the generator protects you
- Cryptographic randomness only. Every character and word comes from
crypto.getRandomValues, the same source browsers use for encryption keys. We use rejection sampling, so no character is more likely than another (the “modulo bias” that naïve generators suffer from). - Nothing leaves the page. There are no network requests after the page loads and no analytics on what you generate. You can switch to airplane mode and keep generating.
- Nothing is stored. Your option choices are remembered in your browser for convenience; the passwords themselves only exist in this tab’s memory.
- Clipboard hygiene. Copied passwords are overwritten after the delay you choose. Browsers only allow a page to write to the clipboard while it is focused, so if you switch away the clear happens the moment you return. Clipboard-history features such as Windows Win+V may still keep a copy.
Setting up a guest network? Share it with a Wi-Fi QR code so nobody has to type your new key. For PINs and numeric codes, the random number generator is the better tool.
Frequently asked questions
Is it safe to generate a password on a website?
It is when the generator runs entirely in your browser, as this one does. The password is made by your own device using crypto.getRandomValues, never transmitted, and not stored. You can verify it in your browser’s developer tools: the Network tab shows no requests when you generate or copy.
How long should my password be?
For accounts saved in a password manager, 16 to 20 random characters with all character types is plenty — over 100 bits. If a site caps the length, use the maximum it allows. For a passphrase you must remember, use at least five words for everyday accounts and six or seven for a master password.
What does ‘bits of entropy’ mean?
It is a measure of how many possible passwords the generator could have produced with your settings. Each extra bit doubles the attacker’s work. Around 60 bits resists casual attacks, 80 bits is strong, and 100 bits or more is beyond any foreseeable brute-force attack, even against a leaked, fast hash.
Why does the site reject my generated password?
Some sites limit which symbols they accept or set a maximum length. Edit the symbol set to include only the symbols the site allows, add awkward characters to ‘Never use these characters’, or lower the length. Spaces, quotes, backslashes and angle brackets are the characters most often rejected.
Are passphrases as secure as random passwords?
They can be, as long as the words are chosen randomly rather than by you. Each word from our 1,400-word list adds about 10.5 bits, so seven words roughly match an 11-character random password. Passphrases are longer to type but much easier to remember and to enter on phones.
Does the generator keep a record of my passwords?
No. The history panel exists only in this tab’s memory so you can grab a password you generated a moment ago. Reloading or closing the tab erases it. Only your settings, such as length and character types, are remembered in your browser’s local storage.