Strong password generator

A password nobody can guess

The weak point of most accounts is a password that is short, predictable or reused. A good password is long, random and different for every site, and no person can invent one like that. This generator does it for you with the secure random number generator built into your browser, the same kind used for cryptography, and it does everything on your device: the password is not sent to any server, it is not stored and nobody, including this site, ever sees it.

Length matters more than complexity

Each extra character multiplies the number of possible passwords. A 16-character password using lowercase, uppercase, digits and symbols has around 105 bits of strength, which puts it far out of reach of any attack. Adding symbols helps, but adding length helps more. The strength meter shows the entropy in bits and an estimate of the time an attacker would need to guess it by brute force, using an assumption of ten billion guesses per second against a stolen password hash. Above about 80 bits is very strong for today's technology.

Three types

• Random characters: the strongest for a given length. Choose which sets to include, and at least one character from each chosen set is guaranteed. You can avoid look-alike characters such as O and 0 or l and 1 if you have to read the password out or type it by hand.
• Pronounceable: groups of easy syllables joined by hyphens, such as kabomi-tenuli-rosafe. They are easier to type and remember but need to be longer to reach the same strength, and the meter tells you exactly how strong they are.
• PIN: digits only, for devices and cards that ask for a number. Short PINs are weak by nature, so use the longest that the system allows.

How to use passwords well

Use a different one for every account, store them in a password manager rather than trying to remember them, turn on two-factor authentication where it is offered, and change a password when a service reports a breach. A generated password is only as safe as the way it is kept, and it is best copied straight into a password manager.

What it does not do

The tool does not save or manage your passwords, check whether a password has appeared in a breach, or protect an account with a poor recovery process. Some sites limit length or symbols; if a password is rejected, use the options to fit their rules. The estimated time is an approximation, not a guarantee.