Password & Passphrase Generator

NIST SP 800-63B revision 4, section 3.1.1.2, requires a password used as the only authentication factor to be at least 15 characters, and at least 8 when it is used alongside another factor. Sixteen random characters from a full pool is about 103 bits, which is past any practical brute-force attack. Length is the lever that matters most: each extra character multiplies the work.

It depends on what you need to do with it. Each word from the EFF long wordlist contributes log₂(7,776) = 12.92 bits, so a six-word passphrase is about 77.5 bits — strong, and something you can actually say out loud. A 16-character random password reaches 103 bits in a quarter of the characters. Use a passphrase where you must remember or dictate it; use random characters everywhere your password manager does the typing.

A guess rate, which is the single largest variable in the whole calculation. This page shows four: 100 guesses per hour (a rate-limited login), 10 per second (an unprotected login), 10,000 per second (an offline attack on a slow hash such as bcrypt) and 10 billion per second (an offline attack on a fast unsalted hash). The headline uses the slow-hash figure, because that is what a competently run service gives an attacker who steals its database. The same password can differ by a factor of a million across those four.

Because the draws stop being independent. Without the option, each position is a free choice from the whole pool, so the count is pool^length. With it, each character used is removed from the pool for the next position, so the count is the falling factorial instead. At 16 characters over an 85-character pool that is a loss of about 2 bits; at 32 characters it is nearly 10. The figure shown is always the one that matches the option you chose.

Very slightly, and only at short lengths. Demanding at least one character from every selected class rules out every string that misses a class, which shrinks the space: about 3.8 bits at 4 characters, under 0.3 bits at 12 and above. It is included because many sites still enforce composition rules, and the cost is counted exactly rather than ignored.

A generator is safe when its randomness is cryptographic and it runs on your device. This one uses crypto.getRandomValues, the browser's own CSPRNG, and generates entirely in local JavaScript — there is no request to inspect and no server-side log. Be wary of any generator that sends what it produces over the network, whatever it promises about retention.

Diceware builds a passphrase by choosing words at random from a fixed numbered list, traditionally with physical dice. This page uses the EFF long wordlist — 7,776 words, five dice rolls each — published by the Electronic Frontier Foundation in 2016 and chosen so the words are easy to spell, easy to type and hard to confuse with one another. The list shipped here is byte-identical to the file EFF publishes.

Include them wherever the site allows, because they enlarge the pool: all four classes give 85 characters against 52 for letters alone, worth about 0.7 bits per character. But do not contort a password to satisfy a rule. NIST SP 800-63B-4 explicitly tells verifiers not to impose composition rules, precisely because they push people toward predictable substitutions like replacing a with @.

Up to 50 in one batch. Copy them all with one click, or download the batch as a CSV file — useful for seeding test accounts or rotating a set of service credentials. The batch is generated locally like everything else, and the CSV is written by your browser, not downloaded from us.

The characters I, l, 1, O, 0, o, the pipe and the backtick — the ones that are routinely misread in a sans-serif font or misheard when read aloud. It shrinks the pool, so the entropy shown drops accordingly; the trade is worth it for a Wi-Fi key or anything that gets typed on a remote control, and rarely worth it for a password your manager fills in.

No. NIST SP 800-63B-4 tells verifiers not to require periodic password changes, and to force one only when there is evidence the password has been compromised. Scheduled rotation reliably produces predictable increments rather than new secrets. Generate a fresh random password when something actually happens.

In a password manager. The whole argument for high-entropy passwords assumes you are not trying to remember them — which is why the one secret that should be a memorable passphrase is the manager's master password. Generate that here in passphrase mode, and let the manager hold everything else.

The two pages measure different things. This one reports the keyspace it drew from, which it knows exactly. The strength checker reports guessability: how few attempts an attacker who knows the common patterns would need, which for a truly random string is a deliberately conservative estimate. The verdict band and the crack times come from one shared model, so the two pages agree on the conclusion even where the bit counts differ.

No. 128 bits is the standard for a cryptographic key, which must resist an attacker who can try keys at hardware speed forever. A password is defended by a slow hash and a rate limit as well as by its own entropy. Once a password is past roughly 80 bits, the realistic risks are phishing, reuse and malware — not brute force — and extra length stops buying you anything.