Password Generator

What makes a password strong

Strength comes from length and randomness. A random 16-character password using letters, numbers and symbols has about 100 bits of entropy, which is far beyond what attackers can guess. Human-made passwords are weak because they follow patterns: names, dates, keyboard runs and common substitutions like @ for a are the first things cracking tools try.

How this generator works

Passwords are created with your browser's cryptographically secure random number generator (crypto.getRandomValues), using unbiased sampling so every character is equally likely. Each password is guaranteed to contain at least one character from every set you select, which satisfies most sites' complexity rules. Nothing is sent to a server or saved.

Tips for using passwords

• Use a password manager so every account can have its own long random password.
• Never reuse passwords. A leak on one site should not unlock your other accounts.
• Turn on two-factor authentication for email, banking and social media.
• Avoid look-alikes (I, l, 1, O, 0) when you need to read or type a password manually, such as a Wi-Fi key.

Entropy explained

The strength shown is calculated as length × log2(size of the character pool). Around 50 bits is fair for low-value accounts, 70 bits is strong, and 100 bits or more is very strong. Need unique identifiers instead of secrets? Use the UUID generator. To check a file download, use the hash generator.

Passphrases as an alternative

If you need a password you can remember, such as the master password for a password manager, a passphrase of five or six random, unrelated words is a good choice. It is long, so it is hard to crack, but easier to type and recall than random symbols. The words must be chosen randomly, not from a song or a quote. For everything else, let your password manager store long random passwords like the ones generated here, and change a password immediately if a service you use reports a data breach.