Tools › Developer › Password generator

Password generator

Strong passwords, passphrases you can actually remember, and PINs, made by your browser's own cryptographic random source. Each one comes with an honest measure of how long it would take to guess.

Unbiased: every character is exactly as likely as every other
Passphrases from the EFF's 7,776-word list, built for exactly this
The strength shown is the strength of what you got, not a guess
Made in this tab and never sent, logged or stored anywhere

Password or passphrase

A password of random characters packs the most strength into the fewest characters, which is right for anything a password manager fills in for you. You never type it, so it does not matter that it is unreadable.

A passphrase is a few random words. Six words from the list here are as hard to guess as a 12-character random password, and far easier to type on a phone or remember for the one password you do have to know: the one that unlocks the manager, or your computer.

What the strength figure means

It is the number of equally likely possibilities, counted in bits: each bit doubles the work of guessing. The time beside it assumes the worst realistic case, an attacker with a stolen database and a rack of graphics cards trying a hundred billion guesses a second. Most sites store passwords in a way that makes each guess thousands of times slower, so real figures are longer. Aim for 80 bits for anything that matters.

The figure is exact. When you ask for at least one of each kind of character, the count covers only the passwords that qualify, which is slightly fewer than it would be without the rule.

Why the random source matters

Math.random(), which many generators use, is predictable: its next output can be worked out from earlier ones. These come from crypto.getRandomValues, the same kind of generator operating systems use for encryption keys. Each draw is also corrected for modulo bias, a common slip that makes some characters more likely than others.

PINs

A PIN is weak by design and relies on the device locking after a few wrong tries. Six digits is a million possibilities, which is fine behind that lock and useless without it. Never use a PIN where a password is allowed.

Questions

Is the password sent anywhere?

No. It is made in this tab and exists only on your screen until you copy it. Nothing is logged or stored, here or anywhere else.

How long should a password be?

Twenty random characters, or six random words, for anything important. Both are well past the point where guessing is practical.

Where do the passphrase words come from?

The Electronic Frontier Foundation's long word list: 7,776 common, distinct words chosen to be easy to spell and hard to confuse. Each word adds 12.9 bits.

Does capitalising the words make it stronger?

No, and the strength figure does not pretend it does. If every word is capitalised, an attacker who knows the scheme simply tries it. Only random choices add strength.

Why leave out look-alike characters?

For a password someone will read off paper or a screen and type. It costs a little strength, which the figure shows.