Password & Passphrase Generator
Password generator with two modes: random strings from an 80-character pool, or EFF wordlist passphrases that print their entropy in bits. Length runs to 256, batches up to 100.
Generated password
1 to 256; every move draws again on the same keystroke.
3 to 10 words, 12.92 bits each.
How to use
- Pick Password or Passphrase under Mode, then set the slider that goes with it: Length for a password, or Words for a passphrase, with the character sets or the separator beside it.
- Everything draws again the moment you touch a control, so press Copy password once the settings look right, or Generate again for a fresh one from the same settings. Raise How many above 1 for a batch, and a Download .txt button turns up under the list.
About this tool
Password generator, first tab, and the default is already a sensible one: 16 characters pulled from all four sets. That pool is 80 characters wide. Uppercase and lowercase bring 26 each, the digits bring 10, and the symbol set is exactly 18 of them, !@#$%^&*()-_=+[]{} and nothing more exotic. Sixteen picks from 80 lands at roughly 101 bits.
The Length slider runs from 1 to 256. Any extra length a site will swallow above 16 is free strength, though in practice you are usually fighting a form that caps at 20 and chokes on half the symbols. Untick Symbols when that happens rather than deleting characters out of the result yourself.
The Passphrase tab makes something you can read down a phone line. Words come from the EFF long list, all 7,776 of them, at 12.9 bits per word. Five words is the default and works out near 65 bits; six gets you about 78. Separator can be a hyphen, a dot, an underscore or a space, and there are tickboxes for capitalising the words and adding a digit. That digit is one character from 0 to 9, appended after the last word with the same separator, worth about 3.3 bits.
Every character and every word comes out of crypto.getRandomValues, with rejection sampling wrapped around it. The sampling matters more than it sounds. Taking a random 32-bit number modulo 80 would quietly favour the first few characters of the pool, so any draw landing in the uneven tail gets thrown away and redrawn.
The meter under the answer shows entropy in bits, worked out from how the secret was drawn and never guessed from the characters that turned up: length times log2 of the pool for a password, 12.9 bits a word for a passphrase. Under 60 bits the Strength card reads fair, from 60 strong, from 80 very strong, and the meter tops out at 129, which is ten words. Whatever it says, use a different secret for every account and keep them in a manager, because a 101-bit password is still worthless once it is on ten sites and one of them leaks.
Good to know
- The settings come back on your next visit, but no password or passphrase is ever kept. There is no history, so a value you skipped past is gone as soon as any control moves and the generator fires again.
- The character sets are a pool, not a quota. With all four ticked every character is still drawn from the same 80, so a short password can legitimately arrive with no digit in it, and a site demanding one will bounce it. Regenerate, or push the length up.
Password questions
Is 16 characters actually enough?
Against a login form with rate limiting, comfortably. The case people worry about is offline cracking, where someone holds the leaked hash and can guess forever, and 16 random characters from the full pool is about 101 bits, well past what any hardware chews through. Where 16 fails is reuse: past a certain point a unique password buys you more than a longer one.
Random password or passphrase, which should I pick?
Depends who has to type it. A manager fills a random string for you, so use those everywhere it can store them. Passphrases are for the handful you type by hand: the laptop login, the manager's own master password, the wifi key you read out to guests. Six EFF words is about 78 bits and you can say it out loud.
Should I still rotate passwords every 90 days?
NIST dropped that guidance years ago, because forced rotation just produces Summer2024! followed by Summer2025!. Change one when something prompts it: a breach notice, a secret you shared with someone, a password you know you reused, or an old one you invented yourself before you had a manager.
Can I pull a batch out in one go?
Set How many up to 100 and the answer becomes a numbered list, each line with its own copy button, plus a Download .txt that saves passwords.txt. Copy all takes every line in one go. Passphrases batch the same way and save as passphrases.txt.
What does the Add a number tickbox do to a passphrase?
It sticks a single digit on the end as an extra chunk, joined by whatever separator you picked, so you get something along the lines of cactus.dosage.spearmint.pouch.unstable.4. It is there for sites that insist on a numeral. The bits it adds are negligible next to the five words in front of it.
How short can a passphrase get before it stops being worth using?
The Words slider bottoms out at 3, and three EFF words come to about 39 bits. The Strength card will still say fair beside that, because every value under 60 bits gets the same label, so read the number and ignore the adjective. Five words is the default for a reason. Seven if it guards your email.
I unticked all four character sets and the password vanished.
There is no pool left to draw from, so the generator stops and says there is nothing to draw from. Tick any single box and a result comes straight back. The half-way case is worth a number: turning Symbols off takes the pool from 80 characters down to 62, which moves a 16-character password from roughly 101 bits to roughly 95. Nobody is cracking either one.
Does Capitalise each word make a passphrase harder to guess?
The entropy figure under the result does not move when you tick it. Each word gets its first letter raised and nothing else about the draw changes, so anyone guessing already knows where the capitals sit. Tick it for a site that demands an uppercase letter. Dragging the slider up one more word is what actually buys strength, about 13 bits of it.
Missing something in Password & Passphrase Generator? Suggest a feature →
Tell someone who needs this.