Free tool
Password Generator: Passwords, Passphrases and PINs with a Strength Readout
Pick a password, a passphrase or a PIN, set the length and the characters, and copy the result. The page shows how many bits of strength it has and how long a guess would take at a speed you choose.
Cmd or Ctrl and Enter makes another. Click the password to copy it.
All of them
Earlier in this tab (0)
Kept only in this tab, so they are gone when you close or reload it.
Words from the EFF long word list (CC BY 4.0, Electronic Frontier Foundation).
Passwords are made in your browser and are never stored, logged or sent. Only your settings are remembered on this device. Earlier passwords stay in memory in this tab and vanish when you close it.
For the accounts that run your website
A site owner has a surprising number of logins: the hosting account, the domain registrar, the CMS, the email provider, the payment tool, the analytics account. One reused password across them is how a small leak becomes a takeover. The plan that works is a different random password for each, kept in a password manager.
This page creates those passwords. It uses the browser's secure random generator and picks each character or word with equal chance, so there is no pattern to guess. It is a generator only. The place to store the result is a password manager, not a note or a spreadsheet.
This is general guidance and not a security audit of your accounts.
Password, passphrase or PIN
| Mode | Settings | Good for |
|---|---|---|
| Password | Length 8 to 128, capitals, small letters, numbers, symbols, at least one of each kind, leave out look-alikes | Accounts kept in a password manager |
| Passphrase | 3 to 12 words from the EFF long list, a separator, capital first letters, an optional number | A password you must type or remember |
| PIN | 4 to 12 digits | Devices and cards that only take numbers |
You can make up to 50 at a time with the How many box. The symbol list can be edited, so if a site refuses certain symbols you can delete them from the set. The look-alike option leaves out I, l, 1, O, 0 and o, which helps when a password has to be read aloud or typed from paper.
What the strength readout means
Strength is shown in bits. For a password it is the length multiplied by the base two logarithm of the size of the character pool. For a passphrase, each word from the list of 7,776 words adds about 12.9 bits, and the optional number adds a little more. The label moves from Weak under 40 bits, to Fair, Strong and Very strong at 80 bits and over.
The page also works out the average time to guess it, taking half of all combinations at a speed you choose, from 1,000 guesses a second to a trillion. That depends on how an attacker gets at the password, so read it as a comparison between settings. Each extra bit doubles the work.
A passphrase of five random words is easier to remember than a 20 character string, yet in the same range of strength.
Handling the password after it appears
- Click the password or press Copy. Press Cmd or Ctrl and Enter to make another.
- Press Clear clipboard once you have pasted it into your manager, since a copied password stays there until you copy something else.
- The Earlier in this tab list keeps your last few in memory only, in case you copied the wrong one. Clear them now removes them.
- Do not send a password in email or chat. Share through the manager.
- Turn on two-step sign-in wherever it is offered.
Keeping website logins tidy is part of looking after a site. Our Webflow maintenance page describes what we look at when we take care of a site over time.
Frequently asked questions
Is the password really random?
Yes. It uses the browser's secure random number generator, and the method discards values that would make some characters more likely than others.
Does the page store or send my passwords?
No. They are made in your browser and are not stored, logged or sent. The settings are remembered on this device, and the passwords are not.
How long should a password be?
Longer is stronger, and the readout shows the effect of each choice. For an account in a password manager, a long random password is easy, since you never type it.
What is a passphrase?
It is a few random words joined together, taken here from the EFF long word list. It is easier to type and remember than a string of symbols.
Why leave out look-alike characters?
The letters I, l and O look like the digits 1 and 0 in many fonts. Leaving them out helps when a password is read aloud or copied from paper.
Can I use these passwords for a bank?
Yes, as a source of random passwords. This is general guidance, not security advice for your case. Use two-step sign-in wherever it is offered.
More free tools
- WiFi QR code generator: Make a Wi-Fi QR code and a printable card so guests can join your network by scanning.
- UUID generator: Make v4, v7 or nil UUIDs in bulk and check whether a UUID is valid.
- username generator: Thirty username ideas at a time in six styles, shaped by your name, length and letter case.
- Base64 decoder and encoder: Decode Base64 to text or a file and encode text or files to Base64 and data URLs.
- JWT decoder: Decode a JSON Web Token, read its claims and expiry, and check the signature with a key.