Strong Password & Passphrase Generator
Create a random password or a memorable passphrase in one click. It is generated on your device with a cryptographic random number generator and never leaves the page.
Building a product with user accounts?
We develop websites and apps with secure sign-in: proper password hashing, two-factor authentication, rate limiting and security testing before launch. Tell us about your project and get an estimate.
Thank you! We will reply within one business day.
TL;DR: this strong password generator creates random passwords from 8 to 128 characters and passphrases from the EFF Large Wordlist. Randomness comes from crypto.getRandomValues, the cryptographic generator built into your browser, and the result is never sent anywhere. For each password you see its entropy in bits and how long it would take to guess it in three realistic attacks.
How to use the password generator
- Choose the type. “Password” gives a random string of characters, “Passphrase” gives several random words that are easier to remember and type.
- Set the length. 16 characters or more for regular accounts, 20 or more for admin panels, servers and password manager master keys. For a passphrase, 6 words is a good default.
- Pick the characters. Keep all four sets on unless a site rejects symbols. Turn on “Exclude look-alikes” if you will read the password aloud or type it from paper.
- Copy it. Press “Copy” and paste the password into your password manager first, then into the site. Need passwords for a team or test accounts? Generate up to 50 at once and download them as a .txt file.
Password or passphrase?
| Option | Example | Entropy | Best for |
|---|---|---|---|
| 16 characters, all sets | q7#Lm9!vR2&xT4pK | ≈ 104 bits | Accounts stored in a password manager |
| 20 characters, all sets | 8Hk!w2#Qz… | ≈ 130 bits | Admin, server and API access |
| 6 EFF words | lantern-oval-cubicle-snore-quilt-baggage | ≈ 77.5 bits | Master password, disk encryption, Wi-Fi |
| 8 characters, letters and digits | k3Vt9qLm | ≈ 48 bits | Only where the service limits length |
A random character password packs the most strength into the fewest characters, so it suits anything you never type by hand. A passphrase is longer but far easier to remember and type on a phone: each word from the 7,776-word EFF list adds 12.9 bits, so six words give about 77.5 bits. That is enough for a master password that you have to know by heart.
What the strength meter shows
Entropy is the number of guesses an attacker needs, written as a power of two. We count it exactly: for a password where every selected set must appear at least once, the tool counts only the passwords that satisfy this rule instead of using the simplified formula “length × log2 of the alphabet”. Crack time is the average time to search half of all possible passwords at a given speed:
- Online login with rate limiting, about 10 guesses per second. This is what a site with lockouts and captchas allows.
- Leaked database with a slow hash such as bcrypt, about 10,000 guesses per second on one machine.
- Leaked database with a fast hash such as unsalted MD5 or SHA-1 on a GPU farm, about 100 billion guesses per second.
The last scenario is the one to plan for: if a service stores passwords badly and its database leaks, only length and randomness protect you. These speeds are rough estimates. They show the order of magnitude, not a guarantee.
What current guidance says
NIST SP 800-63B (revision 4, 2025) puts length first: services should accept passwords of at least 64 characters, should not force composition rules or periodic changes, and passwords used as the only factor should be at least 15 characters long. In practice this means one long random password per site, kept in a password manager, plus two-factor authentication where it is available.
We build web and mobile products at YuSMP Group and use the same rules for logins, admin panels and API keys. If your site or app needs a security review, see our penetration testing and security audits, and check whether your connection exposes your real IP with the DNS and WebRTC leak test.
FAQ
Is it safe to generate a password online?
Here, yes. The password is created by JavaScript on your device with crypto.getRandomValues, the same cryptographic generator browsers use for encryption keys. It is not sent to our server, not saved in the browser and not passed to analytics. You can even disconnect from the internet after the page has loaded and the generator will keep working.
How long should a password be?
At least 16 random characters for regular accounts and 20 or more for admin panels, servers and the master password of a password manager. If you use a passphrase, take 6 words or more. Length adds strength faster than any special character.
What is a passphrase and is it secure?
A passphrase is several random words, for example “lantern-oval-cubicle-snore-quilt-baggage”. It is secure as long as the words are chosen by a random generator rather than by a person. With the EFF Large Wordlist each word adds 12.9 bits, so 6 words give about 77.5 bits and 8 words over 100 bits.
What does entropy in bits mean?
It is the size of the search space as a power of two. A password with 80 bits of entropy is one of 2^80 equally likely options, and an attacker has to try half of them on average. Every extra bit doubles the work. Below 40 bits is weak, 60–80 is good for most accounts, over 100 is very strong.
Why exclude look-alike characters?
The characters 0 and O, 1, l and I are easy to confuse when you read a password aloud, type it from a screenshot or from paper. Excluding them removes 5 characters from the alphabet and costs about 0.1 bit per character, which longer length easily covers.
How is the crack time calculated?
The tool takes the entropy, assumes an attacker finds the password after searching half of all options, and divides by the guessing speed: 10 per second for an online login with limits, 10,000 per second for a database hashed with bcrypt and 100 billion per second for a fast hash on GPUs. Real speeds depend on hardware and hashing settings, so treat the result as an order of magnitude.
Where should I store generated passwords?
In a password manager such as Bitwarden, 1Password, KeePassXC or the one built into your browser. Copy the password into the manager first and only then into the site, so it is not lost if the page reloads. Do not reuse one password on several sites.