Password generator (runs in your browser, nothing is sent)

This free tool makes a random password or passphrase in your browser. It uses your browser’s secure random number generator, and the page never sends or stores what it makes. Use it to give every account its own long, random password. Then save each one in a password manager.

A passphrase is a password made of several random words. A password manager is an app that creates, stores and fills in passwords for you.

How to use the generator

1. Pick Password or Passphrase. Use a password for most accounts. Use a passphrase for secrets you must remember, such as a password manager’s master password.
2. Set the length. For a password, the slider runs from 8 to 64 characters and starts at 20. For a passphrase, it runs from 4 to 10 words and starts at 6.
3. Choose what goes in it. For a password, pick from lowercase letters, uppercase letters, digits and symbols. The tool puts at least one character of each kind you choose. Turn on “Leave out look-alikes” if you will read the password from paper. That option drops 0, O, o, 1, l, I and |. For a passphrase, choose hyphens, spaces or periods between the words.
4. Copy it and save it. Press Copy, paste it into the account, and store it in your password manager before you leave the page. The page does not keep it. Press “Make another” to get a new one.
5. Read the strength estimate. It is in bits. Each extra bit doubles the guesses an attacker needs.

How the generator works

The tool gets its randomness from crypto.getRandomValues, a function built into your browser. MDN’s documentation says it returns cryptographically strong random values, suitable for cryptographic purposes. The tool turns them into characters or words without favoring any, all on your device.

In passphrase mode, the words come from EFF’s long word list. It has 7,776 words. Joseph Bonneau created it for the Electronic Frontier Foundation (EFF), and it is used here under a CC BY 4.0 license with the dice numbers removed.

At its default settings, the tool estimates a 20-character password with all four kinds of characters at about 129 bits. It estimates a six-word passphrase at about 77 bits. EFF says a six-word passphrase from its list is one of about 2^77 possibilities, which makes it very hard to guess by brute force.

These numbers assume a random pick, as this tool makes. A password you invent yourself is usually weaker than its length suggests, because NIST notes that people respond to rules in predictable ways, such as turning “password” into “Password1.”

What makes a password strong

NIST’s rules for passwords are in SP 800-63B-4, final since July 2025. They are written for the companies that run sign-in systems, not for you. They still show what experts now consider good practice:

• Length comes first. A site that uses a password alone must require at least 15 characters. If the password is only one part of multi-factor sign-in, the minimum is eight. Sites should accept at least 64 characters.
• No forced mixing. Sites must not require a mix of character types. That is why this tool lets you choose.
• No routine changes. Sites must not make you change your password on a schedule. They must force a change if there is evidence it was compromised.
• A check against breached passwords. A site must compare new passwords with a blocklist of commonly used, expected or compromised passwords.
• Room for password managers. Sites must allow password managers and autofill.

Passphrases

EFF suggests a six-word passphrase for most uses, and says more words make a stronger one. Let the generator choose the words. NIST notes that people’s own password choices are often predictable. CISA gives similar advice for a home Wi-Fi password: five to seven unrelated words, at least 16 characters in all, never reused for another account. Our guide to home Wi-Fi and router security shows where to set it.

One password per account

NIST says distinct passwords matter because of “password stuffing.” In that attack, someone takes a password exposed at one site and tries it on other sites. NIST also says password managers help people choose stronger passwords. So make a new password for each account, and let the manager remember it.

Has my password been leaked?

Have I Been Pwned runs a free, open-source tool called Pwned Passwords. It tells you whether a password has appeared in known data breaches. Your device scrambles the password into a code, called a hash, and sends only the first five characters. The comparison happens on your side, according to the service.

If a password shows up, the service says it should never be used, and you should change it everywhere you used it. If it doesn’t show up, that doesn’t make it a good password. It only means the password isn’t in the service’s data.

What can go wrong

• A site rejects the password. Some sites still limit length or certain characters. Lower the length or turn off a kind of character, then try again.
• You closed the page too soon. The tool does not store the result. Make a new one and save it right away.
• A fake site gets whatever you type. Check the address before you enter a password.

What to do now

1. Make a new password for your email and bank accounts first.
2. Save each one in a password manager before you close the page.
3. Use a different password for every account, and replace any you have reused.
4. Check an old password at Pwned Passwords. If it appears, change it everywhere you used it.
5. Use a six-word passphrase for the few passwords you must remember.