Strong Password Generator

How to use the password generator

This strong password generator makes passwords the way current security guidance says they should be made: long, random and different for every account. It is free, there is no sign-up, and although it is a password generator online, nothing you make here goes online. Every character is drawn on your own device.

1. Pick a mode. Password is a random password generator for any length from 4 to 128 characters. Passphrase strings random words together. With a name builds a password around a name or word you choose. Funny makes a silly sentence. PIN makes a numeric code, and the Strength checker estimates how guessable a password you type is.
2. Set the length and the characters. Tap a length preset (8, 12, 16, 18, 20, 24 or 32) or drag the slider. Choose uppercase letters, lowercase letters, numbers and symbols. Edit the symbol set if a site rejects some symbols, leave out look-alike characters such as I, l, 1, O and 0 if you will read the password aloud or copy it from paper, or exclude any characters you like.
3. Copy it where it belongs. Paste the password straight into the sign-up form and save it in your password manager. A new password appears whenever you change an option, and the Generate button makes another one.
4. Need more than one? Set the How many field to anything up to 500 and you get a numbered list to copy or download as a .txt or .csv file, handy for test accounts or a batch of temporary logins.

Under every result, a meter shows the password's entropy in bits and how long guessing it would take in three attack scenarios. The default setting, 16 characters from all four character types with at least one of each, rates Very strong at 103.4 bits.

What makes a password strong?

A password is strong when an attacker can't guess it with the time and the number of attempts they have. Guessing is cheap and automated, and attackers don't start with random strings. They start with leaked passwords, dictionary words, names, dates, keyboard patterns and the predictable ways people dress them up: a capital first letter, a 1 or an exclamation mark at the end, @ in place of a. A password survives that only if it was chosen by a random process rather than by a person, and is long enough that trying every possibility is out of reach.

That is why the guidance has moved away from complexity rules. The U.S. National Institute of Standards and Technology's Digital Identity Guidelines, NIST SP 800-63B-4, published in final form in July 2025 and the current revision, put it plainly: “Password length is a primary factor in characterizing password strength.” Websites that follow it “SHALL NOT impose other composition rules”, such as demanding a mix of character types, because “users respond in very predictable ways” to those rules: someone who would have picked “password” picks “Password1”, or “Password1!” when a symbol is required.

These rules are written for websites, not for you. NIST tells sites to require passwords of “a minimum of 15 characters in length” when a password is the only sign-in factor, and at least eight when it is one part of multi-factor authentication. Sites should accept at least 64 characters, including spaces and every printable character, must check new passwords against a blocklist of common and compromised ones, and “SHALL NOT require subscribers to change passwords periodically”; a change is forced only when there is evidence of compromise.

Advice for the public points the same way. The Secure Our World campaign of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), now in CISA's archive, asks for “At least 16 characters—longer is stronger!”, a random string or a passphrase of 4 to 7 unrelated words, a different password for each account, and a password manager to keep track of them. The UK's National Cyber Security Centre (NCSC) suggests three random words for passwords you have to remember, and a password manager for the rest.

Put together, a strong password has three properties:

• Random. Made by a generator, not by you. People are bad at randomness, and attackers know our habits.
• Long. 16 characters or more for a random password, or five or six words for a passphrase.
• Unique. Used on one account only, so a breach at one site can't open your others.

A generator takes care of the first two. A password manager takes care of the third.

How long should a password be? 8 vs 12 vs 16 vs 18 characters

Each character drawn at random from all 94 printable ASCII characters (26 uppercase letters, 26 lowercase letters, 10 digits and 32 symbols) adds 6.6 bits of entropy, and every extra bit doubles the number of possibilities an attacker has to work through. A lowercase letter adds 4.7 bits, so length does more than variety: an 18-character password of lowercase letters alone (84.6 bits) beats a 12-character one that uses every symbol on the keyboard (78.7 bits).

Bits are abstract, so the next table turns them into time. These are illustrative figures under the same three assumptions the tool's meter uses (explained in How the strength meter works): the attacker knows exactly how the password was generated and needs, on average, to try half of all possibilities.

8 characters

A password generator for 8 characters is still a common request, because some older systems cap passwords at eight. Fully random, eight characters hold up against online guessing, but they fall in 8.5 hours on average if a site leaks a database protected by a fast hash. NIST allows eight characters only when the password is one factor of multi-factor authentication. Use 8 only where a system forces it, and turn on a second factor there.

12 characters

Twelve random characters (78.7 bits) are out of reach of a brute-force attack even with a fast hash in our assumptions, at 75 thousand years on average. They are still below NIST's 15-character minimum for a password used on its own, so pair 12 characters with multi-factor authentication or go longer.

16 and 18 characters

Sixteen characters meets CISA's Secure Our World advice and clears NIST's minimum with room to spare. At 104.9 bits from the full character set, or 95.3 bits with letters and digits only, there is no brute-force attack in our scenarios that comes close. A password generator for 18 characters adds two more random characters for almost no effort, since you paste a generated password rather than type it. Go to 20, 24 or 32 characters whenever a site accepts them.

Our recommendation: 16 characters or more, from all four character types, for every account you keep in a password manager. Only shorten it when a site's own limit forces you to, and then add multi-factor authentication.

Passphrases: word passwords that are easy to type

A word password generator, also called a passphrase generator, picks whole words instead of single characters. The Passphrase tab draws from the EFF large wordlist: 7,776 English words that the Electronic Frontier Foundation published for dice-generated passphrases. In 2016 EFF's Joseph Bonneau built it from words that are easy to remember and type, removing words that are hard to spell, easy to confuse or offensive (EFF's write-up). The list has 6⁵ words, one for every result of five six-sided dice, so each word adds 12.9 bits. This generator rolls the dice with the same cryptographic random generator it uses for passwords, so the math is identical.

EFF recommends at least six words from this list, which gives 77.5 bits, about the same as a 12-character random password from the full keyboard. Five words, the tool's default, give 64.6 bits: plenty for an account behind a login that limits attempts. A passphrase is longer than a random password of the same strength, but it is made only of lowercase letters and separators, which makes it far easier to type on a phone, a TV remote or a game console, or to read out to someone.

What about three random words? The NCSC's advice is aimed at passwords people choose and remember themselves, picked so the words have no connection to each other. Three words drawn at random from this list give only 38.8 bits. That is fine against online guessing, but weak if a site leaks a database protected by a fast hash (2.4 seconds on average in our assumptions). For a passphrase you must memorize and that guards a lot, such as the main password of your password manager or your computer login, use six words or more.

The options change the format, and the meter counts only what is actually random. You can separate words with a hyphen, space, period or underscore, use no separator, or put a random digit or symbol between words, which adds real entropy for each gap. Title Case or UPPERCASE adds nothing, because an attacker can guess the format. "One word in caps" adds a little, because which word is random. The optional two digits and symbol at the end exist for sites that insist on them.

Passwords with your name: what works and what doesn't

People look for a password generator with a name because a password that contains their name, a pet's name or a favorite word feels easier to recognize and harder to mix up. The With a name tab does that honestly. Type a name or word, choose whether it appears as typed, capitalized or in l33t (a→4, e→3, i→1, o→0, s→5, t→7), and put it at the start, the end or a random spot next to a run of random characters.

Your name adds no strength. Anyone who targets you can find your name, your children's and pets' names and your favorite team, and guessing tools try names, years and l33t swaps early. The NCSC notes that attackers know these substitution tricks, so a swapped word “won't be significantly stronger”. NIST's blocklist guidance for websites lists “Context-specific words, such as the name of the service, the username, and derivatives thereof” among the passwords to refuse. The meter therefore counts only the random part.

With the default 12 random characters, “Maya” plus the random part rates 77.2 bits, Strong: exactly what the 12 random characters would score on their own. With 16 random characters it reaches 103.4 bits, Very strong.

• What works: a random part of 12 characters or more (16 is better), with the name treated as a label that helps you recognize the password, not as part of its security.
• What doesn't: a name plus a birth year, a name in l33t, or a name with an exclamation mark at the end. All of these are on attackers' lists, and none of them is random.

The name you type stays on the page. It isn't saved with your settings, isn't sent anywhere and is gone when you close the tab.

Funny passwords

The Funny tab is a funny password generator: it builds a silly sentence from word lists of adjectives, animals, verbs and foods written for this tool, in a pattern like Grumpy-Penguin-Juggles-Waffles-42 (an illustration only; never use a password you have seen published). The words are picked at random with the same generator as everything else, so a funny password is a real random password, just a less efficient one.

Those lists are shorter than the EFF list, so each funny word carries fewer bits, and the meter shows the true figure. The default, six words with two digits and a symbol, comes to 67.9 bits, rated Strong. Five words with the same extras drop to 58.5 bits, rated Fair, and four words to 48.8 bits, rated Fair. Keep the six-word default for anything that matters, and save shorter funny passwords for low-stakes logins and for passwords you have to read out loud, like a guest Wi-Fi network, where a laugh helps people type them right.

PINs

A PIN is only safe because something else limits guessing: a phone that locks or slows down after wrong tries, or a bank card that is blocked. Digits alone carry little entropy. A 4-digit PIN has 13.3 bits (10,000 possibilities) and a 6-digit PIN 19.9 bits (one million). Even at our online assumption of 100 guesses per hour, a random 6-digit PIN would be found in 6.8 months on average and a 4-digit PIN in 2.1 days. Without a lockout, an offline attacker gets through all of them almost at once.

The PIN tab picks every digit uniformly, so it never produces the patterns people favor, such as years, repeated digits or runs like 1234. For PINs that unlock a device, NIST tells systems to require at least four digits and recommends at least six, which is why the tab defaults to 6. Choose 6 digits or more where the device allows it, and use a PIN only where the device or bank limits wrong attempts.

How the strength meter works

Entropy measures how many equally likely possibilities a password was picked from: n bits of entropy means 2ⁿ possibilities. For anything this tool generates, we know the exact process, so the meter shows the exact figure for your options: length × log₂(character set size) for a random password, words × log₂(list size) for a passphrase, and an exact count when "at least one of each" is on. The bits then map to a label:

The time to guess assumes the attacker knows exactly how the password was made (the length, the character set or the word list) and tries candidates until one works. On average that takes half of all the possibilities, so the average time is 2^{bits − 1} ÷ guesses per second. The meter shows three illustrative scenarios. They are assumptions for comparing passwords, not predictions:

• Online, rate-limited: 100 guesses per hour. Someone trying passwords at a login page that slows down or locks after wrong attempts. NIST tells sites to allow no more than 100 consecutive failed attempts on an account before disabling that authenticator, so many real sites allow far fewer guesses than this.
• Offline, slow hash: 10,000 guesses per second. Roughly one high-end graphics card working through a stolen database whose passwords were salted and hashed with a deliberately slow algorithm, such as bcrypt with a work factor of at least 10, the minimum the OWASP Password Storage Cheat Sheet recommends.
• Offline, fast hash: 100 billion guesses per second. Roughly one high-end graphics card against a database stored with a fast hash such as MD5 or SHA-1. OWASP warns that fast hashing algorithms are “not suitable for password storage.” NIST's guidelines note that offline attackers can “compute many billions of hashes per second”.

Real attacks can be faster or slower by large factors, depending on the hashing, the hardware and the attacker's budget. An attacker with 100 graphics cards is 100 times faster, which is the same as taking 6.6 bits off the password. A password that falls “instantly” in the fast-hash column is the one to fix first; one that holds out for millions of years even there has plenty of margin.

The Strength checker handles passwords you type, where we can't know how they were made, so it estimates. It splits the password into the pieces an attacker would try first (common passwords, dictionary words including l33t versions, keyboard patterns like qwerty, sequences like abc or 123, repeated characters, dates and years) and adds up the cost of guessing each piece, counting anything left over as random characters. It can tell you a password is weak; it can't prove one is strong, because it doesn't know whether you have used the password elsewhere, whether it has appeared in a breach, or whether it is built from facts about you. The check runs on your device, and nothing you type is sent or saved.

Browser-suggested passwords vs. this generator

Many browsers and password managers offer to create a strong password when you sign up for an account, and save it on the spot. If yours does, use it. A strong password suggested by your browser is a machine-generated random password, one of the mitigations NIST calls “more effective at preventing modern brute-force attacks” than composition rules, and it is saved the moment it is created, so it never sits on your clipboard or a sticky note.

This generator is for the cases a built-in suggestion doesn't cover:

• A specific length or character set: a site caps passwords at 20 characters, rejects certain symbols, or wants digits only.
• Words instead of characters: a passphrase you can type on a TV or game console, on someone else's computer, or read over the phone.
• Passwords outside a web form: a Wi-Fi network, a router's admin page, a computer or phone login, an encrypted drive or backup, an app's configuration file, or the main password of your password manager itself.
• Many at once: up to 500 for test accounts or class logins, as a .txt or .csv file.

Wherever a password comes from, save it in a password manager right away. The NCSC encourages people to use password managers, and NIST requires sites to “allow the use of password managers and autofill functionality.”

Is an online password generator safe?

It is the right question to ask. A password page could, in principle, send what it generates to a server, use a weak random generator, or keep a copy. Here is how this one is built, and how you can check it yourself instead of taking our word for it.

1. Nothing is sent. The generator has no code that uploads anything, and the page's Content-Security-Policy header only allows scripts, connections, images and form submissions to and from this site (connect-src 'self'). To check, open your browser's developer tools (often F12, or right-click the page and choose Inspect), switch to the Network tab and generate a few passwords: no request appears. The only file you may see is this site's own word list, downloaded the first time you open the Passphrase or Funny tab, and nothing goes up with it.
2. It works offline. Once the page has loaded (open the Passphrase and Funny tabs once if you want their word lists), turn on airplane mode or unplug the network and keep generating. Everything still works, because nothing needs a server.
3. Nothing is stored. Generated and checked passwords are never written to local storage, cookies, the address bar or the browser console. The page remembers only your options, such as the length, character types and last tab, in your browser's local storage under the key mpw_settings: no passwords, and never the name you type.
4. The randomness is cryptographic. Every character comes from the Web Crypto API's crypto.getRandomValues, which returns “cryptographically strong random values”. The page never uses Math.random, which “does not provide cryptographically secure random numbers.”

Some limits apply to any generator, this one included. Generate passwords on a device you trust: malware or a malicious browser extension can read any page. A website can change between visits, so the checks above tell you about the copy you are running now. And a generator only makes the password; unique passwords, a password manager and multi-factor authentication are what keep your accounts safe.

Password tips that matter

• Use a different password for every account. Reuse is what turns one site's breach into a break-in everywhere else.
• Keep them in a password manager. It creates, stores and fills your passwords, so you only need to remember one strong passphrase and your device login.
• Turn on multi-factor authentication, especially for email, social media and financial accounts, as CISA advises. Start with email, because it can reset almost everything else.
• Use passkeys where a site offers them. NIST's guidelines describe how a synced passkey (a “syncable authenticator”) creates a key pair tied to the site where it was made, which “prevents a falsified web page from being able to capture and reuse an authenticator output.”
• Don't change passwords on a schedule. NIST tells sites not to force periodic changes. Change a password when there is a reason: a breach notice, a password you have reused, or one you have shared.
• Check for breaches and reuse with your password manager. Many can flag passwords that are reused or have appeared in known breaches. Fix the flagged ones, email and banking first.
• Treat security questions like passwords. A true answer, such as your first school, is often easy to look up. A random answer saved in your password manager is not.

How we generate passwords

Every random choice on this page starts with crypto.getRandomValues, which fills an array with 32-bit random numbers from the browser's cryptographically secure generator. Turning those numbers into characters fairly takes some care:

• No modulo bias. The obvious way to pick one of 94 characters is “random number mod 94”. But 2³² is not a multiple of 94, so 42 of the characters would turn up 45,691,142 times in every 2³² draws and the other 52 only 45,691,141 times. We use rejection sampling instead: a number from the uneven top end of the range is thrown away and drawn again, so every character, word and digit is exactly equally likely.
• “At least one of each” without a pattern. When that option is on, we don't drop one character of each type into fixed spots, which would make positions predictable. We generate the whole password at random and start over if a chosen type is missing, so the result is uniform over every password that follows the rule.
• Exact entropy. The rule removes some possibilities, so we count exactly how many remain, using inclusion–exclusion with big-integer arithmetic. For 16 characters from the default four sets (89 characters), the rule costs very little: 103.4 bits instead of 103.6 bits.
• Every option is counted. Leaving out look-alike characters or excluding characters shrinks the set, and the meter uses the smaller set. Passphrase words, random separators, the position of a name and PIN digits come from the same unbiased picker.
• No shortcuts in the code. Math.random appears nowhere in the generator, an automated test checks that, and no password is ever logged.

Sources

• NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management, section 3.1.1.2 (password verifiers), section 3.2.2 (rate limiting), Appendix A (strength of passwords) and Appendix B (syncable authenticators). Final publication record: NIST Computer Security Resource Center, SP 800-63B-4 (July 2025).
• CISA, Secure Our World: Use Strong Passwords.
• NCSC, Top tips for staying secure online: Three random words.
• NCSC, Top tips for staying secure online: Use a strong and separate password for your email.
• NCSC blog: The logic behind three random words (August 2021).
• Electronic Frontier Foundation: Dice-Generated Passphrases, the source of the EFF large wordlist (CC BY; see Licenses).
• Joseph Bonneau, EFF Deeplinks (July 2016): EFF's new wordlists for random passphrases.
• OWASP Password Storage Cheat Sheet, on slow password hashing (bcrypt work factor, unsuitable fast hashes).
• MDN Web Docs: Crypto.getRandomValues().
• MDN Web Docs: Math.random().
• MDN Web Docs: CSP connect-src.

Reviewed by microplugins · Last updated October 2026