Password generator

How to use the password generator

Press Make a new one. The page draws a password, and a polished metal cylinder spins its rings one by one until each locks on a character. Use the length slider and the kinds of characters to change it, then Copy. The strength meter under it says how hard that setup is to guess, in bits. Quick starts set up the usual jobs: a website login, letters and numbers only, a PIN-style number or the longest the page makes.

Four more tabs sit beside it. Passphrase builds a password from random words, which is easier to type and remember. Wi-Fi code turns your network name and password into a code guests scan with a phone camera. Check a password estimates the strength of one you already have. How long to guess it turns bits into time under stated attacks.

Length beats symbols

A guesser has to try every possibility, so what matters is how many there are. Each character you add multiplies the possibilities by the size of the character pool. NIST's current guidance for online accounts (SP 800-63B-4, July 2025) asks sites to require at least 15 characters when a password is the only sign-in step, to accept at least 64, and not to force symbols or capital letters. A long password of plain words beats a short jumble with a symbol in it.

Worked example: 8 characters from letters and numbers is 8 × 5.954 = 47.6 bits. Twelve characters from all four kinds is 12 × 6.48 = 77.2 bits (a little under, because "at least one of each" removes a few). That is 30 more bits than the first, so it takes about 2^30, or roughly 1.1 billion times, as many guesses.

How a password is picked

Your browser's crypto.getRandomValues() supplies secure random numbers, the kind built for cryptography; Math.random() is not used, because browsers say it is not secure. A random number does not split evenly into 89 characters, and the few values that would favor early characters are thrown away and drawn again, so every character in the pool has exactly the same chance. The draw happens first. Only then does anything move: each ring spins and lands on the character already chosen, so the animation can never change the result.

The rules for picky sites are applied by drawing again until one is met. The strength number counts exactly how many passwords the rules allow, not a rough guess, so a rule that removes possibilities lowers the number honestly.

Passphrases and dice

A passphrase is several random words. The page uses the EFF's long word list: 7,776 words, each tied to five rolls of a six-sided die (6 × 6 × 6 × 6 × 6 = 7,776). One word is log2(7,776) = 12.92 bits, so 51.7 bits for four words, 64.6 for five, 77.5 for six and 90.5 for seven. Four random words (51.7 bits) beat eight random letters and numbers (47.6 bits), and they are far easier to type on a phone.

The words must be random. Words you pick because they mean something to you are guessed much faster than the arithmetic suggests. Press Roll real dice for each word to see five dice faces turn into each word, the same way you would do it with real dice on a table.

Making a password easy to remember

• Use words, not tricks. Swapping a for @ barely slows a guesser, because guessers try those swaps. Adding another random word helps far more.
• Pronounceable passwords use consonant-vowel syllables. Six syllables is 37.9 bits, and they can be said aloud.
• Pick from five. Choosing the one that feels right among five costs a little strength, so the page takes log2(5) = 2.32 bits off the number.
• Say it and practice it. The phonetic reading helps when you read a password to someone, and the practice box checks that you can type it back.
• A password manager remembers the rest. Use one master passphrase and let it fill the others.

The Wi-Fi code

A Wi-Fi password for WPA or WPA2 is 8 to 63 characters. The router software we read says newer WPA3 passwords are not bound by that limit, but staying inside it is the safe choice, so the Wi-Fi tab never makes one longer than 63. The code is a QR picture of the text WIFI:T:WPA;S:name;P:password;;, with a backslash in front of any semicolon, comma, colon, quotation mark or backslash in the name or password. Phone cameras read it and offer to join. You can make a new password there or type the one you already use. The code holds your password, so keep it off public posts. If you change the Wi-Fi password later, make a new code.

How long to guess it

Bits convert to time by dividing the possibilities by the guesser's speed. On average a guesser finds a password after trying half of them. The page tests three attacks. A website login that locks the account is limited by throttling: NIST sets 100 failed tries as the most before disabling the account, so the chance of a hit in 100 tries is 100 ÷ 2^bits. A stolen database is the dangerous case. With a fast hash such as MD5, one graphics card made 164.1 billion guesses a second in a published 2022 test, and with bcrypt at cost 10 about 5,750 a second (the same test at cost 5, scaled, since each step doubles the work).

These are models. Real attackers have more cards, smarter guesses and better lists than a simple count, and the page says "about" for a reason.

Where the numbers come from

• Random numbers: the Web Cryptography API, Crypto.getRandomValues() (MDN Web Docs).
• Password rules: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (final, 31 July 2025): minimum and maximum lengths, no composition rules, no forced periodic changes, a blocklist of common passwords, 100 failed tries at most.
• Word list: the EFF's long word list, for use with five dice, published at eff.org/dice under a Creative Commons Attribution license. Credit: Electronic Frontier Foundation.
• Common passwords: the 1,000 most common entries of the SecLists 10k list (MIT license, Daniel Miessler and contributors).
• Wi-Fi limits: the hostap wpa_supplicant documentation says a WPA-PSK ASCII passphrase is 8 to 63 characters and that SAE (WPA3) passwords do not have that limit. The Wi-Fi code text follows the ZXing project's Barcode Contents page.
• Guess speeds: hashcat v6.2.6 benchmark on one NVIDIA RTX 4090, MD5 164.1 GH/s and bcrypt (cost 5) 184.0 kH/s, published by Chick3nman on 14 October 2022.

No laboratory has tested or certified this page. It is not a replacement for a password manager.

Mistakes that weaken a password

• Reusing one password on several sites. One leak then opens them all.
• A word with a number on the end, such as a season and a year. These are the first thing a guesser tries.
• Using personal facts: names, birthdays, pets, teams.
• Typing a real password into a checker on a website. Use a look-alike instead.
• Thinking a symbol makes it safe. Length does more.

Questions

Related calculators

A 20+ year homeowner and DIY'er, former repair shop owner, now building AerialQuote in Buffalo, NY.