About the Password Generator

This tool creates passwords, passphrases, PINs and usernames using your browser's built-in cryptographic random number generator, and it can estimate the strength of a password you already have. It is meant for people who want a strong, unique secret for each account and a quick way to check whether a password meets a site's rules.

How to generate a strong password

1. Open the Password Generator section and set the length. Use at least 16 characters for accounts you care about, and more for anything that guards other passwords, such as a password manager.
2. Leave uppercase, lowercase, numbers and special characters switched on unless a site refuses certain symbols.
3. Press Regenerate until you are happy, then Copy.
4. Paste it straight into the site's password field, or better, into your password manager so you never have to remember it.
5. Use a different password for every account.

How to use each generator

Password Generator

Controls length, character types, exclusions, repeat rules and required characters. Pronounceable and memorable modes trade some strength per character for passwords that are easier to say or type.

Passphrase Generator

Joins randomly chosen words with a separator. Each extra word adds a fixed amount of strength, so more words always means a stronger passphrase.

PIN Generator

Creates numeric codes. A PIN is only safe when the service limits wrong guesses, so choose the longest PIN the service accepts.

Password Strength Checker

Analyses a password you type, entirely in this page. It also checks a password against a rule set such as a minimum length or required character types.

Bulk Tools

Generates many values at once, detects duplicates and exports them as TXT or CSV. A file of passwords is sensitive, so delete it as soon as you have used it.

Username Generator

Builds usernames from word patterns. Email aliases need support from your email provider, as explained in the Advanced Features area.

How length and character choice affect security

Strength comes from how many equally likely possibilities an attacker has to try. Each additional character multiplies that number by the size of the character pool, so length helps far more than complexity. A 12-character password drawn from 94 printable characters has about 79 bits of entropy. A 16-character password from the same pool has about 105 bits. Dropping from 94 to 62 characters (no symbols) costs about 0.6 bits per character, which a few extra characters easily make up.

Excluding characters, preventing repeats and forcing one of each type all shrink the pool of possible results slightly. The simulator in the Advanced Features area shows by how much.

Passphrases and PINs compared with passwords

A passphrase of random words is easier to remember and type than a random character string of similar strength. This tool's word list is limited, so assume an attacker knows it. Each word then adds roughly nine bits. Five words give about 46 bits, which is fine for low-value accounts; six to eight words are a better choice for important ones.

A PIN has only ten possibilities per digit, so a six-digit PIN has under 20 bits. That is acceptable only because the system holding it locks you out after a few wrong tries.

Reading strength, entropy and crack-time estimates

Entropy is measured in bits; every added bit doubles the number of guesses needed. For a generated password the estimate assumes the attacker knows your settings and has to try every combination. For a password you type, the checker also penalises patterns such as years, sequences, keyboard runs and common words, but it cannot know everything an attacker knows, so treat it as a rough guide.

Crack-time figures divide the average number of guesses by an assumed guessing speed. The speeds are examples, from a rate-limited login to a GPU cluster attacking a fast hash. Real speeds depend on how the service stores your password. No estimate here is a guarantee, and a strong password does not help if it is phished, reused or stolen from your device.

Password privacy and safe handling

• Generation and analysis happen in your browser. Generated and checked passwords are not sent to this site, to analytics, or to any other service, and they are not saved in saved profiles or settings files.
• Store passwords in a reputable password manager rather than a notes file, spreadsheet or email.
• Turn on multi-factor authentication, or passkeys where offered, for important accounts.
• Clear the clipboard and results when you finish, especially on a shared computer. The Advanced Features area has controls for this.
• Change a password when you suspect exposure. Routine forced changes are no longer recommended by current NIST guidance.

Comparison of the generators

Common uses and examples

• New online account: a 20-character password with all types, saved in your password manager.
• Wi-Fi network: a six-word passphrase that guests can read out and type.
• Site with strict rules: use the rules validator to confirm a candidate meets the policy before you submit it.
• Setting up many accounts: generate a batch in Bulk Tools, copy each into your password manager, then clear the results.
• Shared device or SIM: a PIN of the longest length allowed, without repeated or sequential digits.

Frequently asked questions