Strong password generator

Password, passphrase or PIN

• A password of random characters is the strongest for its length. Use it for anything a password manager fills in for you, where you never type it.
• A passphrase of random words is easier to remember and type: harbor-velvet-mosaic-pebble-canyon. Use it for the few passwords you must know by heart, such as the one for the password manager itself or your computer.
• A PIN is only digits. It is weak on its own and relies on the device locking after a few wrong tries, as phones and bank cards do.

How strength is measured

The generator measures strength from the way a value was made, not from how it looks. A character drawn from 89 possible ones adds about 6.5 bits; a word drawn from 7,776 adds about 12.9. Each bit doubles the number of guesses an attacker needs. The times shown are for an average search, half of all possibilities, at three speeds: an online attack at 1,000 guesses a second, a fast offline attack at 10 billion, and a large cluster at a trillion.

These figures hold only for values chosen at random. A password a person invents, such as a word with a capital letter, a year and an exclamation mark, falls to rule based attacks far sooner than its length suggests. How long it takes to crack a password explains why.

The settings

• Length matters most. Every extra character adds about 6.5 bits.
• Kinds of characters: lowercase, uppercase, digits and symbols. Include every selected kind makes sure at least one of each appears, which many sign up forms demand.
• Symbols to use can be edited, for the sites that refuse certain symbols.
• Avoid look-alikes leaves out characters that are easy to misread, such as I, l, 1, O and 0, for passwords you have to read aloud or type from paper. The default password drops from 129.5 to 125.3 bits, still far beyond reach.
• No repeated characters slightly lowers the entropy and is rarely worth it.
• Passphrase options: the separator, capital letters, which add no strength since the pattern is known, and a number, which adds about 9 bits to five words.

Using it safely

Every character and word comes from crypto.getRandomValues, the random generator browsers provide for cryptography, with each choice drawn without bias. Generation happens on your device; the values are never sent anywhere or saved by the page. Use a different password for every site, keep them in a password manager, and use Hide values before you share your screen.

If a site rejects the password

• It is too long. Some sites cap the length. Lower it, but keep at least 16 characters if you can.
• A symbol is not allowed. Remove that symbol from the list of symbols to use.
• It needs a digit or a symbol. Keep Include every selected kind switched on.

How we tested. Entropy is the number of characters or words times the base 2 logarithm of the number of possible choices: 89 characters with all kinds selected, 7,776 words. Times are half of all possibilities divided by the guess rate, as the generator shows them.