A new password is ready below. Change the length or the character types and it updates at once; copy it, or take one of the alternatives underneath.
Your password
Average time to crack by brute force
At 10 billion guesses a second, an offline attack against a fast hash.
More passwords
Generated in your browser. Nothing is sent or stored.
Every character you add multiplies the number of possible passwords by the size of the alphabet. With all four types ticked that alphabet has 85 characters, so each extra character multiplies an attacker’s work by 85. Ticking symbols only grows the alphabet from 62 to 85, which is worth about half a bit per character. That is why 16 lowercase letters (75 bits) beat 10 characters of every type (63 bits): at the speed assumed below, the long plain one holds out for tens of thousands of years and the short complicated one for about twenty.
The time shown assumes ten billion guesses a second, roughly what a few graphics cards manage against a password stored with a fast hash such as MD5, after a site’s database leaks. It is the pessimistic case on purpose. Against a properly stored password (bcrypt, Argon2) the same attack is millions of times slower, and against a login page that locks after a few attempts it goes nowhere. The figure is an average: on average the right guess turns up halfway through the possibilities.
When you tick a character type, every password here contains at least one of it. The usual way to guarantee that is to reserve a slot for each type, which quietly changes the odds and makes some arrangements likelier than others. This generator draws the whole password from the full alphabet and, if a ticked type is missing, throws it away and draws again. Every acceptable password is then exactly as likely as any other, which is what makes the entropy figure an exact count rather than an estimate. The characters come from crypto.getRandomValues, the browser’s cryptographic source, with the same rejection step the random number generator uses against modulo bias.
The symbols leave out ^, ~, ` and ´ because on Brazilian, German, French and Spanish keyboards they are dead keys: typing one takes two presses, and a password copied on a laptop turns into something else when retyped on a phone or a TV. Quotes, backslashes and spaces are out because they break forms and spreadsheets. And there is one limit no generator can fix: a strong password stops brute force, not reuse. If the same password sits on two sites and one of them leaks it in plain text, its length no longer matters. One password per site, kept in a password manager, is the part that actually protects you.
This one is created entirely in your browser, by code running on your device. It is not sent to a server, logged or stored: you can load the page, switch off your connection and keep generating. The site is static, so there is no server code that could receive it even by mistake.
For an account that matters, 16 characters of every type: about 102 bits, beyond any brute-force attack. Twelve is a reasonable minimum. Eight, still the minimum on many sign-up forms, falls in hours under the assumption used on this page.
It is the number of passwords the generator could have produced, written as a power of two. 60 bits means 2^60 possibilities, about a billion billion, and each extra bit doubles the attacker’s work. It describes how the password was made, not the string itself: the same characters chosen by a person are worth far less, because people do not choose at random.
Zero and capital O, one, lowercase L and capital I are hard to tell apart in many fonts. Leaving them out costs a little entropy, about 0.1 bit per character, and is worth it when the password will be read and typed by hand, like a Wi-Fi password printed for guests.
For most accounts, no. A random 16-character password is meant to be stored in a password manager, which also fills it in for you. The few you must type from memory, such as the manager’s own master password, work better as a long phrase of random words.