Password generator

Length beats complexity

Each extra character multiplies the number of possibilities. A 16-character password drawn from about 80 symbols has roughly 100 bits of entropy, far beyond any guessing attack; a short one with a symbol swapped for a letter does not. Use a different password for every site and keep them in a password manager.

How to use the password generator

Set the length, choose whether to include symbols, decide whether to leave out look-alike characters (0, O, 1, l and I) and choose how many passwords to generate. Press the button and copy the one you want. Each result is built in your browser from your device’s secure random number generator, and nothing is sent anywhere or stored. The heading shows the approximate entropy in bits.

What makes a password strong

Strength comes from the number of possibilities an attacker has to try. That is the size of the character pool raised to the power of the length. Every extra character multiplies the work by the pool size, so length matters more than clever substitutions. Entropy in bits is length × log₂(pool size). A 16-character password from letters, digits and symbols (94 characters) has about 105 bits. A 12-character password from letters and digits (62 characters) has about 71 bits.

What the bits mean

At 10 billion guesses a second, exhausting 71 bits would take thousands of years, while 47 bits would fall in hours. Those speeds apply to stolen password databases that are attacked offline, which is why length matters.

Good habits

• Use a different password for every account. One leak should not unlock the others.
• Use a password manager. It remembers long random passwords so you do not have to.
• Turn on two-factor authentication wherever it is offered.
• Never share passwords by email or chat, and do not reuse one after a breach.
• Prefer length for passwords you must type. A long phrase of four or more random words is easy to remember and strong.

Why leaving out look-alikes helps

Characters such as zero and capital O, or lowercase l, capital I and the digit one, are easy to mix up when you read a password aloud or copy it by hand. The look-alike option removes them. It slightly shrinks the pool, which costs under half a bit per character, a trade that is nearly always worth it for passwords you will type yourself.

Is it safe to generate a password online?

This generator runs entirely in your browser, using the browser’s cryptographic random source. The page does not send the password to a server. As a general rule, generate passwords with a tool you trust, do not paste them into unknown sites and save them straight into your password manager.

Passphrases as an alternative

For a password you must remember, such as the one for a password manager, use a passphrase of four to six random words. A list of 7,776 words gives about 12.9 bits per word, so five random words are around 65 bits, and six reach 77. The words must be chosen at random, not picked as a quote or a lyric, otherwise the strength falls dramatically.

When a site limits your password

Some sites cap the length or reject certain symbols. In that case, pick the longest length allowed and turn symbols off if needed, because a longer letters-and-digits password still beats a short one with symbols. Never reduce your safety by reusing a shorter password elsewhere; use a unique one for each site.

Common mistakes

• Predictable substitutions. “P@ssw0rd” is on every cracking list.
• Using personal information. Names, birthdays and pet names are easy to guess.
• Making passwords too short. Under 12 characters is risky for important accounts.
• Reusing a strong password. Strong and reused is still one breach from failing.