These rules cannot all be met. Turn off No repeated characters, allow more character types, or shorten the password.
Edit to match what a site allows. Letters, digits and spaces are ignored.
1 to 500
Test a password you already use
Checked on this page only. Nothing is sent or stored.
How to use
Choose a password, passphrase or PIN
Press Random password for a string of characters, Memorable passphrase for random words, or PIN for digits only. Passphrases are easier to type and remember, while random passwords pack more strength into fewer characters.
Set the rules
For passwords, set the length or tap a preset, tick A-Z, a-z, 0-9 and symbols, and add exclusions such as look-alikes or Begin with a letter. For passphrases, pick words, separator and capitals. For PINs, pick 4 to 12 digits.
Check the strength, then copy
Read the bits and average crack time, then press Copy. Set How many above 1 for a list with Copy all, Download TXT and Download CSV. Tick Remember these settings to keep your rules for next time.
Why Password Generator
- Random passwords, word passphrases and PINs from one page.
- Exclude look-alikes, ambiguous symbols, repeats, runs or any character you name.
- Entropy in bits and an estimated crack time for every setting.
- Up to 500 at once, made with crypto.getRandomValues() in your browser.
Password length, entropy and crack time
The figures below use the same formulas the tool shows. They assume a fast offline attack: someone has stolen a database of password hashes stored with a fast hash and tests 10 billion guesses per second on graphics cards. Sites that use slow hashes such as bcrypt or Argon2, or that lock accounts after failed logins, make every row much safer.
Two patterns stand out. Each extra character multiplies the work by the size of the character set, so length beats complexity. And each passphrase word adds about 10.6 bits, a little more than one and a half random characters, which is why passphrases need 6 words or more.
| Setting | Entropy | Average time at 10 billion guesses per second |
|---|---|---|
| 6 digit PIN | 20 bits | Less than a second (safe only behind a lockout) |
| 8 characters, letters and digits | 48 bits | About 3 hours |
| 8 characters, all four types | 52 bits | About 2 days |
| 12 characters, all four types | 78 bits | About 340,000 years |
| 16 characters, all four types | 103 bits | More than a billion years |
| 20 characters, all four types | 129 bits | More than a billion years |
| 4 word passphrase plus a digit | 48 bits | About 3 hours |
| 6 word passphrase plus a digit | 69 bits | About 1,100 years |
| 8 word passphrase plus a digit | 91 bits | More than a billion years |
Passphrase, random password or PIN: when to use each
All three are fine when they are long enough and truly random. The real difference is who has to type them, how often, and whether the system locks after wrong guesses.
If you are unsure, use random passwords for everything a password manager can store, and learn one passphrase for the manager itself.
- Random password: for accounts your password manager fills in, such as shopping sites, forums and work apps. 16 to 20 characters is plenty.
- Passphrase: for anything you type by hand or from memory, such as a password manager master password, a computer login or a Wi-Fi network.
- PIN: only for devices and cards that lock after a few wrong tries. Never use a PIN as an online password.
- Awkward sites: if a site rejects some symbols, edit Symbols to use or tick Exclude ambiguous symbols, and add two characters of length.
- Never reuse: one breach exposes every account that shares the same password.