Password generator
Create strong random passwords in your browser and check how long they would take to crack.
Time to crack: —
Time to crack: —
Nothing you type is sent anywhere or stored — the check runs in your browser.
How to generate a password
- Set the length with the slider or the number field. Sixteen characters is a good default for most accounts.
- Tick the character types you need. Many sites require at least one digit and one symbol.
- Turn on "Exclude look-alike characters" if you have to read the password from a screen and type it somewhere else.
- Pick how many passwords you want and press "Generate again" until one looks right.
- Copy a single password with its button, or copy the whole batch and paste it into your password manager.
When it helps
- Creating a password for a new account without inventing something predictable.
- Replacing a password that was leaked in a data breach.
- Filling a password manager with a batch of fresh entries.
- Making a one-off password for a Wi-Fi network or a shared device.
- Checking how strong an existing password really is before you keep using it.
Frequently asked questions
Why does length matter more than symbols?
Every extra character multiplies the number of guesses an attacker has to try, while adding a symbol only widens the alphabet once. Going from 12 to 16 characters adds far more work than swapping a letter for a symbol, and long passwords are also easier to type.
Where are the passwords created?
Entirely in your browser. The page uses the Web Crypto API, the same random source your browser uses for encryption, and it never sends, stores or logs anything you generate or type.
How does the strength estimate work?
The checker looks at which character classes appear in the password, works out the size of the alphabet they form, and multiplies the logarithm of that size by the length. That gives the entropy in bits. The result is then reduced for obvious patterns such as repeated characters, runs like abcd or 1234, and a short list of the most common passwords.
What are the limits of that estimate?
It is a rough guide, not a guarantee. It cannot know whether your password appears in a leaked database, whether it is built from your name and birthday, or whether an attacker is targeting you personally. A password that scores well here can still be weak if it is reused or easy to guess.
Should I use a password manager?
Yes. A manager lets you keep a different long random password for every account and remember only one master passphrase. That removes the temptation to reuse a password, which is the single biggest risk in practice.
Can I reuse a password if it is very strong?
No. When one site is breached, attackers try the same address and password everywhere else. A unique password means one broken account instead of all of them.