Strong Password & Passphrase Generator
A strong password is long and random: 16 or more characters mixing letters, numbers and symbols. For something you must remember, use a passphrase of 5 or more random words. Both are generated in your browser using your device's secure random source and never sent anywhere.
Estimated time to crack by brute force: 129,273,630 billion years
How this generator works
Passwords are built with the browser's cryptographic random number generator (crypto.getRandomValues), the same source used for encryption keys. Nothing is sent to a server, logged or stored.
Strength is estimated from entropy: length × log₂(character pool size). Each extra character multiplies the number of guesses an attacker needs, which is why length matters more than tricks like swapping letters for symbols.
Passphrases: strong and memorable
Passphrase mode picks words at random from the EFF Long Wordlist, which has 7,776 words. Each word adds about 12.9 bits of entropy, so 5 words is roughly 65 bits and 7 words is roughly 90 bits. The words must be chosen at random by the generator: a phrase you invent yourself, such as a song lyric, is far easier to guess.
Frequently asked questions
- How long should a password be?
- At least 14 to 16 characters for important accounts. Use a password manager so you never need to remember them.
- Is a passphrase better than a password?
- For something you have to remember, yes. Five or more random words are strong and easier to type than a string of symbols, which suits a password manager's master password. For everything else, let a password manager store long random passwords.
- Is the time to crack estimate exact?
- No. It assumes a fast offline attack of 10 billion guesses a second. Real attackers vary, so treat it as a comparison between passwords, not a promise.