Password and passphrase generator

Two kinds of password

A passphrase is several random words in a row, such as five unrelated words with hyphens between them. It is long, which makes it strong, and it is made of real words, which makes it possible to remember and easy to type on a phone. Use passphrases for the few passwords you must keep in your head: your phone's or computer's login, your main email and your password manager.

Random characters pack more strength into fewer characters but cannot be remembered. Use them for everything else, saved in a password manager that types them for you.

How to use the generator

1. Choose Passphrase or Random characters.
2. Adjust the length. The strength line updates as you move the slider.
3. Tap Make another until you get one you like, then Copy.
4. Paste it into the "new password" box of the site or app, and save it in your password manager at once. The page does not keep it; if you close the tab without saving, it is gone for good.

Some sites insist on a capital letter, a digit or a symbol. The passphrase options add a capital and a number; if a site demands a symbol, the hyphens between words count as one. A few old sites refuse long passwords or certain symbols: shorten the length or untick Symbols for those.

How strong is strong enough?

The page shows strength as bits of randomness: each extra bit doubles the number of guesses an attacker needs.

Five random words from this page's list, with a number, give about 50 bits; seven words give about 67, and 16 random characters of all four kinds about 98. Because a genuine service slows down or blocks repeated wrong guesses, even a "fair" password holds against online guessing. The higher figures matter when a company's password file is stolen and attackers can guess at full speed.

Strength figures here assume the password was made at random by this tool. A password you invent yourself is far weaker than its length suggests, because people choose predictably.

How the generator works, and why you can trust it

• The choices are made with your browser's cryptographically secure random number source, the same kind used for encryption, not with a simple formula.
• Everything happens on your device. The password is not sent to us or to anyone, not written to storage and not placed in the address bar. You can load the page, switch to flight mode and generate passwords offline.
• Look-alike characters (the digit 0 and the letter O, the digit 1 and the letters l and I) are left out of random passwords, so that they can be read aloud or copied by hand without mistakes.
• Passphrase words come from a list of short, common, inoffensive words written for this site.

After you have made it

• One password, one account. Never reuse it. See strong passwords.
• Add a second lock: two-step verification or a passkey.
• Do not email or message the password to yourself. Save it in the password manager built into your phone or browser, or in a stand-alone one.
• Never tell it to a caller, whoever they say they are.