How to generate a strong password
- Choose Random password for a mix of characters or Passphrase for words.
- Set the length (8 to 128) and tick the character sets you want. Turn on Exclude look-alikes if you will read the password aloud or type it by hand.
- Select Generate. Use Copy to put the result on your clipboard, then paste it straight into your password manager.
The strength box shows the entropy in bits, which is how hard the password is to guess.
How the generator works
Your browser provides a cryptographically secure random number generator. A common shortcut is to take a random number and use the remainder (the modulo) to pick a character, but that makes some characters slightly more likely. This tool uses rejection sampling instead: it throws away the few random values that would cause bias, so every character has exactly the same chance.
Every character set you select is guaranteed to appear at least once, and the characters are then shuffled so the guaranteed ones are not always at the start. Passphrase mode picks words from a built-in list of more than 800 plain English words. Five words from that list give about 48 bits, and each extra word adds almost 10 bits.
Tips for safer accounts
- Use a different password for every account, and keep them in a password manager so you do not have to remember them.
- Prefer length over complexity. A 20 character password beats an 8 character one with symbols.
- Turn on two-factor authentication where it is offered. Never share an authenticator secret or a recovery code in a QR code or a link.
- Never reuse a password you have typed into another site or sent in a message.
- Change a password at once if a service reports a breach.
Generated passwords exist only in this page. We never see them, and there is no history to clear.
When to use a passphrase
Passphrases are best for the few passwords you must type from memory, such as your password manager’s master password or a laptop login. Pick five or six words, keep the dash separator, and turn on Add a number if a site demands a digit. For everything else, a long random password stored in a manager is the strongest choice.
To share a Wi-Fi password safely with guests, the QR code generator can turn it into a code they scan once.