Password Generator
Strong random passwords and passphrases.
About this tool
Generate random passwords with the characters you choose, or word-based passphrases that are easier to type. Everything uses the browser’s cryptographically secure random generator, and the estimated strength is shown in bits.
How to use it
- Choose Random characters or Passphrase.
- Set the length or number of words, and which characters to include.
- Watch the strength estimate in bits update.
- Copy a password, or click Generate new for another set.
Questions
- How long should a password be?
- Aim for at least 16 random characters, which is around 100 bits, or a passphrase of 10 or more words from this tool. Anything above about 80 bits is far beyond what can be guessed. A password manager can remember it for you.
- What does bits of strength mean?
- It measures how many guesses an attacker would need: every extra bit doubles the work. It assumes the password was generated randomly, which is true here.
- Are the passwords stored or sent anywhere?
- No. They are generated in your browser with crypto.getRandomValues and disappear when you close the page.
- Passphrase or random characters?
- Passphrases are easier to type and remember, for example on a phone or a TV. Random characters pack more strength into fewer characters. The strength meter shows exactly how many bits each setting gives you.
- Why are look-alike characters skipped?
- Characters like l, 1, I, O, 0 and o are easy to confuse when a password is read aloud, copied from paper or typed from another screen. Skipping them shrinks the pool slightly and costs about 0.1 bit per character. Turn it off if the password will only ever be pasted.
- How do I generate a random API key or secret token?
- Choose Random characters with only letters and digits, so the key is safe in headers, URLs and config files, and set the length to 32 or more. That gives well over 180 bits. On the command line, openssl rand -hex 32 does the same job. Store such keys hashed if your server only needs to check them.
- Do capital letters and a number make a passphrase stronger?
- Capitalising every word adds nothing, because it is always done the same way. The random number adds about 9 bits for a six-word phrase: up to 100 values in any of seven positions. One more word adds about 8.7 bits, so the two help about equally, and an extra word is often easier to type.
How is password strength in bits calculated?
For a randomly generated password, strength is the length times log2 of the number of possible characters. Lowercase, uppercase, digits and the 27 symbols here make 89 characters, about 6.5 bits each, so 20 characters give about 130 bits. Skipping look-alikes removes six characters and costs about 0.1 bit per character. The formula only holds for random passwords, never for ones a person made up.
Passphrases work the same way with words. The word list here has 422 short words, so each word adds about 8.7 bits and six words give about 52. That is less per word than the classic Diceware list of 7,776 words, which gives 12.9 bits each, so use more words to reach the same strength. The meter does this maths for you as you change the settings.
Why is my generated password rejected or breaking things?
Some sites cap the length at 16 or 20 characters, or refuse certain symbols such as quotes, spaces or angle brackets. Lower the length to the site’s limit, or turn off Symbols and make the password a few characters longer to make up for it. Each extra letter or digit adds almost 6 bits, so 22 alphanumeric characters beat 20 with symbols.
Symbols also cause trouble outside websites. In a shell, $ and ! inside double quotes are expanded, so wrap such passwords in single quotes. In a .env file, # can start a comment and $ can trigger variable expansion. In a database connection URL, @, : and / break the parsing unless you percent-encode them with the URL Encode tool. Letters and digits only avoid all of this.
NIST password guidelines: what actually matters
NIST SP 800-63B, the US government guideline many companies follow, puts length before complexity. Its 2025 revision asks for at least 15 characters when the password is the only factor, 8 with multi-factor login, and support for at least 64. It also says to drop rules like “one symbol and one digit”, to stop forcing regular password changes, and to block passwords found in breach lists.
The practical version: a unique random password for every account, kept in a password manager, plus a second factor wherever offered. Use a long passphrase for the few secrets you have to type, like the manager’s master password. If you build the login yourself, store passwords with Argon2id or bcrypt. Fast hashes like SHA-256 from the Hash Generator are fine for checksums, not for stored passwords.
Something not working, or a result looks wrong? Report a problem with this tool