How long should a random password be?

Twelve characters is a reasonable floor. Use sixteen or more for anything that protects money, email, or identity.

Is a passphrase weaker than a short password?

A four-word passphrase drawn from a large word list carries more randomness than a short password and is easier to type on a phone.

Free tool

Generate a password on your own device

Build a random password or a passphrase with the browser's crypto API. The value is created in this page and never leaves it, so there is no server log to worry about.

Random numbers from the browser, not from the server Each value is drawn from a cryptographic random source on this device and discarded when you leave the page.

Password

Random characters

Local only

Generated password

Strength: not generated yet

Length

Include

Lower-case letters
Upper-case letters
Digits
Symbols
Avoid look-alike characters

Look-alike characters are letters such as l and I next to the digit 1. Skipping them makes a password easier to read aloud.

Passphrase

Words you can type

Local only

Generated passphrase

Strength: not generated yet

Words

Separator

Capitalise each word
Append a two-digit number

Passwords and passphrases

A long random password is hard to guess and hard to type. A passphrase made of several unrelated words is easier to type and still gives you a lot of guessing room. Pick the one you will actually use.

What the strength label means

The label estimates how much guessing the value would take, based on its length and the character sets you selected. It is a rough guide, not a guarantee, and it says nothing about whether a service will store your password properly.

Storing what you generate

Put the value in a password manager rather than a note or a chat message. If you need to send one to someone, the one-time secret tool on this site keeps it to a single read.

Is anything sent to the server?

No. The value is built in the page from the browser's cryptographic random source. There is no request while you generate, so nothing appears in a server log.

Should I use a password or a passphrase?

Use whichever you can type accurately on the device in front of you. A five-word passphrase is long enough for most accounts, and a twenty-character random password is stronger still if you are pasting it from a manager.

Can I generate the same value twice?

Not on purpose. Each run draws fresh randomness, so a reload gives you a different value. Save the one you keep.