Quick answer
A strong password is long and truly random: 16 characters mixing upper and lower case, digits and symbols give about 103 bits, which would take billions of years to crack even at 10 billion guesses per second. Press “Generate again” above to get one, and use a different password for every account.
What makes a password strong?
Generate random passwords of 8 to 128 characters, or memorable passphrases built from Vietnamese (without accents) or English word lists. Every character is drawn with the browser's crypto.getRandomValues, with rejection sampling so each character is exactly as likely as the next. Strength is shown in bits and as an average cracking time, so you can compare settings with numbers instead of gut feeling.
How to generate a password
- 1
Pick a type: “Random password” for accounts stored in a password manager, “Memorable passphrase” for things you type by hand (your computer login, Wi-Fi, the password manager itself).
- 2
Drag “Length” (16 or more recommended) or “Words” (5 or more recommended) and choose the character types or word list.
- 3
Turn on “Skip look-alike characters” if the password will be read aloud or typed from paper.
- 4
Check the strength: the bar, the bit count and the average cracking time update as you change settings.
- 5
Click “Copy” next to the one you want, or “Generate again” for a fresh set. Nothing is stored: close the page and they are gone.
Length versus strength for random passwords
Figures for an 87-character set (upper, lower, digits, 25 symbols) at 10 billion guesses per second; times are averages (found halfway through the search).
| Length | Bits | Rating | Average time to crack |
|---|---|---|---|
| 8 characters | ≈ 51.5 | Fair | about 2 days |
| 12 characters | ≈ 77.3 | Strong | about 300 thousand years |
| 16 characters | ≈ 103.1 | Very strong | over a billion years |
| 20 characters | ≈ 128.8 | Very strong | over a billion years |
Swipe sideways to see the whole table →
Human-made passwords (a name plus a birth year, dictionary words) are far weaker than these numbers because attackers try those patterns first.
Random password or passphrase?
| Random password | Passphrase | |
|---|---|---|
| Example | q7#Vt$9mKp2!wXzR | Maple-Harbor-Cotton-Falcon-Ivory-42 |
| Strength | 16 characters ≈ 103 bits | 5 English words + a number ≈ 50.4 bits; 7 words ≈ 61.3 bits |
| Easy to remember and type | No, keep it in a password manager | Yes, also on a phone keyboard |
| Best for | Websites, apps, API keys | Computer login, Wi-Fi, your password manager's master password |
Real-world examples
Banking and email
A 16-character random password with all four types, saved in a password manager, with two-factor authentication turned on. One password per site, so a breach on one site doesn't unlock the others.
Guest Wi-Fi
Four or five words joined by hyphens with look-alike characters skipped: easy for guests to read and type on a phone, and far harder to guess than a phone number or birthday.
A site that allows only 12 characters and no symbols
Set the length to 12 and untick “Symbols”. 62 characters × 12 ≈ 71.5 bits, still rated Strong; the bit count updates instantly so you can see exactly what dropping symbols costs.
Temporary passwords for a team
Set “How many” to 20 to get twenty different passwords at once, click “Copy all” and paste them into a spreadsheet; ask everyone to change theirs on first sign-in.
Common problems
- Reusing one password everywhere.
- When one site leaks, attackers immediately try the same password on email and banking (credential stuffing). Use one password per account and a password manager to remember them.
- The site says the password is invalid.
- Some sites cap the length or reject certain symbols. Shorten to the site's limit, or turn off symbols and add length to keep the bits up.
- Typing a password from paper goes wrong.
- Turn on “Skip look-alike characters” so there is no 0 / O or l / 1 / I, or use a passphrase.
- Decorating a familiar word (P@ssw0rd1).
- Those substitutions are in every cracking dictionary, so they add almost nothing. Use a machine-generated random password.
- Sending passwords over chat or email.
- Messages stay in history. Share through your password manager's sharing feature, or send a temporary password and ask for it to be changed right away.
How the generator works
Each character is drawn with crypto.getRandomValues, the browser's cryptographic random source (never Math.random). To avoid bias, values that fall into the uneven tail are discarded and redrawn (rejection sampling) instead of using a remainder.
With “At least one of each selected type” on, a password missing a type is redrawn in full rather than patched at a fixed position, so the result stays uniformly random.
Passphrases draw each word at random from hand-picked lists of common words (letters a–z only). Their strength comes from the number of words and the size of the list, not from how unusual a word looks.
Reading the bit count
Bits = length × log2(number of possible characters). Every extra bit doubles the number of possibilities: 60 bits is roughly a thousand times harder to crack than 50.
The cracking time assumes an attacker has the password hash and a rig trying 10 billion guesses per second. Online logins are far slower because attempts are rate-limited, so the real margin is larger; on the other hand, no length protects a password that has already leaked.
- Under 28 bits: very weak
- 28–35 bits: weak
- 36–59 bits: fair
- 60–79 bits: strong
- 80 bits and up: very strong
Glossary
- Entropy (bits)
- A measure of unpredictability: how many times the space of possibilities must be halved. An n-bit password has 2ⁿ possibilities.
- Passphrase
- A password made of several random words, easier to remember and type than a jumble of characters.
- Password manager
- Software that stores and fills passwords (built into browsers and phones, or a separate app), making one password per site practical.
- Credential stuffing
- Using email and password pairs leaked from one site to try logging in to many others.
- Two-factor authentication (2FA)
- A second step after the password, such as an app code or security key, so a leaked password alone is not enough.
Frequently asked questions
Are the passwords sent anywhere or stored?
No. They are created in your browser, never sent to a server and never saved; close the page and they are gone.
How long should a password be?
16 or more random characters for important accounts, at least 12 if a site limits length. Passphrases should have 5–6 words, plus a number if the site requires one.
Is a Vietnamese passphrase less secure?
Strength depends on the number of words and the size of the list, not the language. The Vietnamese list here is shorter than the English one, so each word carries slightly fewer bits; the tool shows the exact bit count so you can add words.
Should I change passwords on a schedule?
Not if each password is strong and unique. Change it straight away if the site reports a breach or you suspect someone knows it.
Why skip the letter O and the digit 0?
Read over the phone or copied by hand, 0 and O, or l, 1 and I, are easily confused. Dropping these five characters costs very few bits and avoids typos.
Does it work offline?
Yes. Once the page has loaded, generation runs entirely on your device.
Ratings and comments
Loading…