Is it safe? Does my password go anywhere?

It is made in your browser with crypto.getRandomValues — the same secure random source browsers use for encryption keys — and only ever shown on your screen. Nothing is sent or logged. Only your option choices (such as length and which character types) are remembered in this browser; the passwords themselves never are.

Password or passphrase — which is better?

Both can be strong. Six random words from the 7,776-word EFF list are about 78 bits of strength — the same as a random 12-character password using letters, numbers and symbols — but far easier to type and remember. Use random passwords for things a password manager fills in, and a passphrase for the few you must remember.

How is the strength worked out?

For generated passwords it is exact: length × log2(size of the character pool), or words × log2(7,776) for a passphrase. The crack time assumes an attacker making about 10 billion guesses a second against a fast, unsalted hash. For a password you type in Check strength it is only a rough estimate — it spots common passwords, keyboard runs, sequences, repeats and years but is not a full dictionary check, so treat a good score as 'not obviously weak', not a guarantee.

What do 'Avoid look-alike characters' and 'Website-safe symbols' do?

Avoid look-alikes leaves out I, l, 1, O, 0, o and | so a password can be read aloud or retyped without mistakes. Website-safe symbols limits symbols to ! @ # $ % & * ? - _ + =, which almost every site accepts — some reject brackets, pipes and other punctuation.

Does every selected character type really appear?

Yes. If symbols are switched on, the password is guaranteed to contain at least one; the same goes for uppercase, lowercase and numbers. Their positions are then shuffled.

Utility

Password Generator

Strong random passwords and easy-to-remember passphrases, made with your browser's secure random generator. Never sent anywhere, never logged.

—

Options

Length16

Uppercase (A–Z)Lowercase (a–z)Numbers (0–9)Symbols (!@#$…)

Avoid look-alike charactersLeaves out I, l, 1, O, 0, o and | so it's easy to read aloud or retype.Website-safe symbols onlyUses only ! @ # $ % & * ? - _ + = — accepted almost everywhere.

Every type you switch on is guaranteed to appear at least once.

*Estimated time for an attacker with a fast offline setup (about 10 billion guesses a second) to find it on average. Websites that limit login attempts are much harder to attack.

How it works

1
Choose Random password, Passphrase, or Check strength to test one you already have.
2
Set the length (or number of words) and the options you want.
3
Copy the result. A new one is made whenever you change an option or press Generate.

Password Generator — frequently asked questions

Is it safe? Does my password go anywhere?: It is made in your browser with crypto.getRandomValues — the same secure random source browsers use for encryption keys — and only ever shown on your screen. Nothing is sent or logged. Only your option choices (such as length and which character types) are remembered in this browser; the passwords themselves never are.
Password or passphrase — which is better?: Both can be strong. Six random words from the 7,776-word EFF list are about 78 bits of strength — the same as a random 12-character password using letters, numbers and symbols — but far easier to type and remember. Use random passwords for things a password manager fills in, and a passphrase for the few you must remember.
How is the strength worked out?: For generated passwords it is exact: length × log2(size of the character pool), or words × log2(7,776) for a passphrase. The crack time assumes an attacker making about 10 billion guesses a second against a fast, unsalted hash. For a password you type in Check strength it is only a rough estimate — it spots common passwords, keyboard runs, sequences, repeats and years but is not a full dictionary check, so treat a good score as 'not obviously weak', not a guarantee.
What do 'Avoid look-alike characters' and 'Website-safe symbols' do?: Avoid look-alikes leaves out I, l, 1, O, 0, o and | so a password can be read aloud or retyped without mistakes. Website-safe symbols limits symbols to ! @ # $ % & * ? - _ + =, which almost every site accepts — some reject brackets, pipes and other punctuation.
Does every selected character type really appear?: Yes. If symbols are switched on, the password is guaranteed to contain at least one; the same goes for uppercase, lowercase and numbers. Their positions are then shuffled.