Password generator
Pick a length and the kinds of characters you want. Every password is made on your device and never leaves it.
Runs in your browser. Passwords are not sent to a server or stored.
How strong is strong enough?
Strength here is measured in bits: the number of guesses an attacker would need, written as a power of two. A random 16-character password using all four kinds of characters has about 103 bits, far beyond what any computer can guess. The meter calls anything under 40 bits Weak, 40 to 60 Fair, 60 to 80 Strong and 80 or more Very strong. These figures only hold for passwords made at random like these; a password you invent yourself is usually much weaker than its length suggests.
Under the meter, the same number is written as time: how long a computer trying one trillion guesses a second would need, on average, to hit your password. On average means half of all the possible passwords, since an attacker is as likely to find it early as late.
Length and character types compared
Every row below is what this generator reports for that setting. "All four" means capitals, small letters, digits and symbols, a pool of 87 characters.
| Length | Characters | Bits | Meter | Time to guess |
|---|---|---|---|---|
| 6 | Digits only (a PIN) | 19.9 | Weak | Instantly |
| 8 | All four | 51.5 | Fair | About 27 minutes |
| 10 | All four | 64.4 | Strong | About 144 days |
| 12 | Small letters and digits | 62.0 | Strong | About 27 days |
| 12 | All four | 77.3 | Strong | Thousands of years or more |
| 16 | Small letters only | 75.2 | Strong | About 691 years |
| 16 | All four | 103.1 | Very strong | Longer than the age of the universe |
| 16 | All four, no look-alikes | 101.4 | Very strong | Longer than the age of the universe |
The sum behind each row is length × log2(pool size). For 12 characters from all four kinds, 12 × log2(87) = 12 × 6.44 = 77.3 bits. Compare the 16 small letters with the 12 mixed characters: four extra letters from a small pool get you almost as far as all the symbols. Leaving out look-alikes (I, l, 1, O, 0 and o) shrinks the pool from 87 to 81 and costs under two bits at 16 characters, a fair trade for a password you have to type from paper. For a numeric PIN, the random number generator can draw the digits: set it to 0 to 9 and pick as many numbers as the PIN has digits. The 12, 16, 20 and 32 buttons above the slider jump straight to the common lengths.
Length matters more than symbols. Adding four characters to a password does more than adding symbols to it, which is why the guidance from the US National Institute of Standards and Technology (NIST SP 800-63B) focuses on length and on blocking common passwords rather than on forcing special characters.
Good habits
- Use a different password for every account, so one leak can't unlock the others.
- Store them in a password manager rather than a note or a spreadsheet; then length costs you nothing.
- Turn on two-factor sign-in for email and banking, the accounts that can reset all the others.
- Leave out look-alike characters if you'll ever have to read the password aloud or type it from paper.
How the passwords are made
Characters are drawn with your browser's cryptographic random generator, the same source used for encryption keys, with no bias toward any character. Each kind you tick is guaranteed to appear at least once, then the whole password is shuffled so you can't tell where the guaranteed characters are. That guarantee rules out passwords that are missing a kind, so the strength shown is a slight overestimate: for passwords of 12 characters or more the difference is under one bit. Nothing is logged, saved or sent: refresh the page and the password is gone for good, so copy it before you leave.
Questions
Is it safe to make a password on a website?
It's safe when the password is made on your own device, as it is here. You can check by turning off your internet connection after the page loads; the generator keeps working.
Why does a site reject my password?
Some sites limit length or allowed symbols. Lower the length or untick Symbols and generate again.
Is 12 characters long enough?
For a random password with all four kinds of characters, yes: 77 bits would take a trillion-guesses-a-second computer thousands of years. If a site only allows letters and digits, go to 16, which gives about 95 bits. Eight characters, still the minimum on many sign-up forms, comes out as only Fair even with every kind of character ticked.