Password generator

How the password generator works

Set the length and the groups of characters and the tool makes five passwords at once, so you can take the one that is easier to copy out or remember. They are created right in your browser with a cryptographic random number generator (the Web Crypto API), so none of them travels to a server or is stored anywhere.

The strength meter works out the entropy: the length of the password multiplied by the information carried by one character of the chosen alphabet. A sixteen character password of letters, digits and symbols lands around a hundred bits, which is out of reach of brute force with today's hardware.

What actually makes a password strong

Length, mostly. Following the NIST recommendations (SP 800-63B), a twenty character password of nothing but lowercase letters is safer than an eight character mix with an exclamation mark in it. Rotating passwords on a schedule is no longer recommended: all it achieves is people adding a number to the end. Change a password when you suspect it has leaked.

Frequently asked questions

Why leave out look-alike characters?

Zero and capital O, or the digit one, lowercase l and capital I, look identical in many fonts. When you type a password out by hand or read it over the phone, leaving them out saves a mistake. Security drops only marginally: add a couple of characters of length and you are even.

Where should I keep the password?

In a password manager. Nobody remembers a strong password for every service, and a note in a browser or on an unlocked phone is a weaker link than the password itself.