Password Generator
Create a strong password in one click: a memorable passphrase, letters and numbers, every character, or a token. Free and private.
Several random words. Easy to remember and to type.
Your passphrase
An estimate based on the number of possible combinations.
Your passwords stay on your deviceThey are generated and calculated in your browser. We never send or save them.
How it works
- Pick the type: a memorable passphrase, letters and numbers, all characters, or a token or hash.
- Adjust the length or the number of words. The password is generated again every time you change an option.
- Press “Copy” and paste it where you need it. Keep it in a password manager: nothing is saved here.
Related tools
Bcrypt hash generator
Generate bcrypt, Argon2id and PBKDF2 hashes ready to store in your database, and check whether a password matches a hash.
Merge PDF
Combine several PDFs into one document and put them in any order.
Image to PDF
Turn your photos and images into a PDF document.
MOV to MP4
Convert MOV videos, like those from an iPhone, to MP4 right in your browser.
Frequently asked questions
Is the password I generate sent or saved?
No. It is created in your browser, on your own device, and it is not sent to our servers or saved anywhere: not in cookies, not in the browser’s storage, not in the page address. It is gone when you close or reload the page. The only thing we measure, anonymously, is which kind of password is generated, never its value.
How random is it? Is it secure?
It uses your browser’s cryptographically secure random number generator (Web Crypto), the same one used to create encryption keys, and it picks every character or word without favoring any. Nothing predictable is involved. If your browser did not have it, the tool creates no password instead of making one up with something weaker.
Is a passphrase better than a random password?
Both can be equally strong if they are long enough. A passphrase of random words is easier to remember and to type, which makes it the best choice for a password you have to memorize, such as the one for your password manager or your computer. A random password with letters, numbers and symbols is shorter for the same level of security and is ideal when a password manager stores it. A phrase taken from a song or a quote is not suitable: the words have to be random.
How long should a password be?
The longer, the better. As a rule of thumb, about 16 random characters or a passphrase of 5 or 6 words is enough for almost any account; for the most important ones, such as your email or your password manager, use more. The tool shows an estimate of strength in bits of entropy: from 60 bits it calls the result strong and from 80, very strong.
What is a token for, and what is a hash?
A token is a long random string used as an API key, a secret or a verification code: you do not need to remember it, only to make sure nobody can guess it. A hash is a “fingerprint” of a text: the same text always gives the same result and it cannot be reversed to get the original back, although a short, predictable text can be guessed by trying possibilities. It is used to check that a piece of data has not changed, not to hide it.
Is SHA-256 good for storing my users’ passwords?
No. SHA-256, SHA-384 and SHA-512 are designed to be very fast, and that speed helps anyone trying to guess passwords at millions of attempts per second. To store passwords, use an algorithm built for it, slow on purpose and salted, such as bcrypt, scrypt or Argon2.
Should I use a password manager?
Yes, it is the best advice. It lets you have a different, long, random password for every account without having to remember them: you only memorize one passphrase to open the manager. Copy the password here, store it in your manager and do not reuse it on other sites. Also turn on two-step verification for your important accounts.