utilyfe

Password Generator

Strong random passwords, passphrases and PINs, made the moment you open the page, and seen only by you.

Runs entirely in your browser. Nothing you enter is uploaded or stored.

Very strong · 129 bits

Guessing it would take longer than the age of the universe at 10 billion tries a second.

20 characters from 89, with at least one of each kind, gives 129 bits: every possible password equally likely.

Settings

Random · 20 characters · A⁠–⁠Z a⁠–⁠z 0⁠–⁠9 !@#$ · No look-alikes

Only you ever see it. It's made on your device with the same grade of randomness used to create encryption keys, so no character is more likely than another and there's no pattern to predict. Nothing is saved or remembered: close the page and it's gone.

Also try:Hash GeneratorUUID GeneratorBase64 Encoder and Decoder

How to use the Password Generator

  1. 1Pick the kind you need: Random for a password manager or a website, Passphrase for one you'll type or remember, PIN for a card or phone.
  2. 2Adjust the settings: length, which characters to use, whether to leave out look-alikes such as 1 and l. A new one appears as you change them.
  3. 3Check the strength line underneath. It shows how many bits of randomness you have and roughly how long guessing would take.
  4. 4Press Copy, or New for a different one. To set up several accounts at once, raise How many and copy or download the whole list.

What makes a password strong

Two things: it’s hard to guess, and it’s used in only one place.

Hard to guess means there are too many possibilities to try. That comes from length and from how many characters each position could be, but only when every position is picked at random. A password you make up is far weaker than its length suggests, because people choose in predictable ways: a word, a capital at the front, a number and a symbol at the end. Attackers try those patterns first.

Because every character here is picked at random from a known set, the number of possible passwords can be counted exactly, rather than estimated the way strength meters on sign-up forms do. The strength line shows that count in bits, with the sum that gives it.

Used in only one place matters just as much. When one site leaks its passwords, attackers try them on every other site, so a password reused anywhere is only as safe as the weakest site you used it on. Make a new one for each account and let a password manager remember them.

Random password, passphrase or PIN

  • Random password. Use for everything your password manager saves and fills in. 16–20 characters with all four kinds is more than enough; go longer only if a site allows it and you like the margin.
  • Passphrase. Use for the few passwords you type by hand or need to remember. Six words drawn at random are strong and far easier to type on a phone than a string of symbols.
  • PIN. Use for bank cards, phones and door codes: places that lock or block after a few wrong tries. Never as a website password.

How the randomness is kept fair

Every character, word and digit comes from the same cryptographic random source your device uses to make encryption keys, not the predictable kind of randomness used for games and animations.

Turning a random number into one of 89 characters takes care, too. Random numbers come in fixed-size chunks that don’t divide evenly by 89, so the obvious shortcut makes a few characters very slightly more common than the rest. This generator throws away any draw that falls into the uneven leftover and draws again, so every character has exactly the same chance.

“At least one of each kind” gets the same treatment. The usual method drops one of each kind in and shuffles, which quietly makes some passwords more likely than others. Here, a password that’s missing a kind is thrown away and made again, so every password that meets the rule is equally likely, and the strength shown already allows for the ones ruled out.

Many at once

Setting up accounts for a team, a class or a batch of test users? Raise How many and the page makes up to 100 in one go. Copy the whole list, copy them one by one, or download them as a text file. Each one is made separately and is exactly as strong as the strength line says.

Where the words come from

Passphrases use the EFF long word list from the Electronic Frontier Foundation, licensed under CC BY 3.0 US. Its 7,776 words were chosen to be easy to remember and to spell, so each word adds about 12.9 bits. The list is part of this page and loads the first time you pick Passphrase.

Questions

Why should I trust a website to make my password?
You don't have to take our word for it. Once this page has loaded, switch off Wi-Fi or mobile data and press New: random passwords and PINs keep coming, because they're made on your device, not on a server. Nothing you make is sent anywhere or stored.
Is the password saved anywhere?
Not by this page: there's no history and no cookie, and reloading gives you a fresh one. Copy does put it on your clipboard, and some phones and computers keep a clipboard history, so paste it into your password manager straight away and copy something else afterwards if that matters to you.
What do the bits mean?
Bits count how many different passwords your settings could have produced, all equally likely: each extra bit doubles the number. 20 random characters from 89 gives 129 bits; a 6-word passphrase with a number gives about 83 bits. Past about 80 bits, no known way of guessing comes close.
How is the time to guess worked out?
It assumes someone has stolen a website's password file and tests 10 billion guesses a second on their own computer: roughly one good graphics card against a weakly protected file. A rig of many cards can be 100 times faster; a site that stores passwords properly makes each guess thousands of times slower. The bits don't change either way, which is why they're the figure to go by.
Should I use a random password or a passphrase?
Use random passwords for anything your password manager fills in: you never type them, so length and symbols cost nothing. Use a passphrase for the few you have to type or remember: the password manager itself, your computer login, your phone. Six random words are easier to type and still very hard to guess.
Why leave out look-alike characters?
In many fonts 1, l and I look alike, as do 0 and O. Leaving them out avoids mistakes when you read a password off a screen or paper. It barely changes the strength: 20 characters from 89 instead of 94 is 129 bits instead of 131.
Why did the number I typed change?
Length runs from 4 to 128 characters, words from 3 to 20 and PINs from 4 to 12 digits. If you type something outside that, it's moved to the nearest limit and a note under the box says so: nothing changes without you being told.
Are six-digit PINs safe?
Only where the device limits wrong tries: a phone that locks, or a bank card that's blocked after three. A PIN has so few possibilities (a million for six digits) that it should never be used as a password for a website or an account.