Strong password generator
Creates a random password for your password manager, or a passphrase made of English words that you can actually remember. It also shows how strong the result is.
How to use it
- Choose what you need: a random password if you'll keep it in a password manager, or a passphrase if you have to remember it (for example, the password to your computer or the master password of your password manager).
- Set the length or the number of words. The defaults are enough for most accounts.
- Click Generate password. If you don't like the result, click Generate another.
- Copy the password and save it straight away in your password manager or set it on the account. Use a different one for every account.
How it works
The most common way an attacker takes over someone's account isn't a clever hack – it's a weak or reused password. When passwords leak from one service, criminals try them in bulk everywhere else. That's why every account should have its own long, random password.
How the tool creates a password
Characters and words are picked by your browser's built-in cryptographic random number generator (crypto.getRandomValues), not by a predictable "random number" function of the kind ordinary programs use. Every character has the same chance of being chosen, so there's no bias.
- Random password – uses the character sets you choose (lowercase and uppercase letters, digits, symbols) and includes each chosen set at least once, so it's accepted even by services with strict rules.
- Passphrase – made of randomly chosen English words. The tool has a list of several hundred words, and every extra word makes the passphrase stronger.
Where to keep it
- Turn on two-step verification for important accounts (email, banking, social media). It protects you even if your password leaks.
- Never use the same password in two places.
- Don't share your password with anyone – your bank, a delivery company or "tech support" will never ask you for it.
- If you've typed your password into a fake site, change it right away on the real site and on every other account where you used the same one.
FAQ
Does the site keep my password?
No. The password is created by a script right in your browser, using its built-in secure random number generator. Nothing is sent to a server and the page stores nothing. The tool even works offline.
Is a random password or a passphrase better?
Both are strong, as long as they're long enough and generated at random. A random password is shorter but hard to remember, so it belongs in a password manager. A passphrase of seven or more random words is longer, but easy to remember and to type on a phone.
How long does my password need to be?
The US National Institute of Standards and Technology (NIST) says in SP 800-63B that services should require at least 15 characters for a password that is the only thing protecting an account, and at least 8 characters when two-step verification is on. A generated password of 16 or more characters, or a passphrase of 7 words, clears that bar comfortably.
What do the bits in the strength rating mean?
Bits describe how many guesses an attacker would have to try: every extra bit doubles the number. The figure only applies to passwords generated at random by this tool. A password you make up yourself is in reality much weaker, because people choose predictably.
Should I change my password regularly?
There's no need, as long as it's strong and you don't use it anywhere else. NIST advises against forcing regular password changes. Do change it straight away, though, if the service reports a data breach or you suspect someone knows it.
Sources
Updated