mockstack.

Password Generator

PASSWORD ← Developer & Data

Random passwords and passphrases, with their strength in bits and how long they would take to guess.

Password

READY RUNS LOCALLY

About the Password Generator

Makes random passwords and passphrases with the browser’s cryptographic random number generator, one at a time or up to 50 at once, and shows how strong they are. Nothing it makes is saved, only your settings.

Every Setting

Kind
Password is random characters, the most strength for the fewest characters, and the right choice when a password manager fills it in. Passphrase is random words from the EFF’s list of 7,776, easier to type and remember for the few passwords you enter by hand.
Length
From 4 to 128 characters. Each extra character adds about 6 bits with all four kinds of character on.
Characters
Which kinds of character to draw from. The symbols box holds the exact set, so a site that allows only some symbols can be matched. Avoid Look-Alikes leaves out characters that are easy to misread when a password is typed from a screen. At Least One of Each makes sure every kind you picked appears, which some sites require.
Words / Separator
How many words, and what goes between them. Capitalize Words and Add a Number are for sites that demand a capital or a digit; the number adds a few bits and the capitals add none.
Count
How many to make. Raising it adds new ones at the end and lowering it trims from the end. New replaces the whole batch, as does any change to the other settings.
Strength
Measured in bits of entropy, worked out from the settings rather than guessed from the result: every bit doubles the number of guesses needed. The time is the average for an attacker trying 100 billion guesses a second, a fast offline attack on a leaked database. Under 45 bits is weak, 60 is fair, and 80 or more is very strong.

Common Questions

How long should a password be?
With a password manager, 20 random characters is plenty. For one you type, six random words is about as strong and far easier to enter.
How should I store a password on a server?
Never as plain text. Hash it with bcrypt or Argon2; the Hash Generator makes and checks both.

Related: Hash Generator, UUID Generator.

Passphrase words from the EFF Large Wordlist by the Electronic Frontier Foundation, used under CC BY 3.0 US.