Generate passwords
Uses uppercase, lowercase, numbers and symbols. The best choice for email, social media, online shopping and most other services.
- Character pool
- 90 characters
- Entropy
- ~104 bits
- Estimated time to crack
- Over 1 trillion years
Advanced settings (character types)
Your passwords
Passwords are generated in your browser and are never sent or stored anywhere.
How to use the password generator
- Choose a length: use the slider, the number box or a preset button to pick 4 to 128 characters.
- Choose a strength: select Low, Medium, High or Max to suit your purpose. If unsure, High is recommended.
- Copy and use: pick any of the 8 passwords and press "Copy" to copy it to your clipboard.
If a service restricts which characters you can use (for example, no symbols), open "Advanced settings" to choose character types individually.
Password strength guide
A password's strength depends on the variety of characters and its length. The more character types and the longer the password, the harder it is to crack by brute force.
| Strength | Characters | Suggested length | Best for |
|---|---|---|---|
| Low | Lowercase, numbers | 8+ | Temporary or low-importance accounts |
| Medium | Uppercase, lowercase, numbers | 12+ | Services that don't allow symbols |
| High | Uppercase, lowercase, numbers, symbols | 16+ | Email, social media, online shopping and most services |
| Max | Uppercase, lowercase, numbers, symbols | 32+ | Online banking, admin accounts, Wi-Fi and other critical uses |
* "Estimated time to crack" is an average assuming an attacker can make 10 billion guesses per second.
Tips for creating and managing secure passwords
- Never reuse passwords: use a different password for every service. If one leaks, attackers will try it everywhere else.
- Make it long: adding length is the most effective way to increase strength.
- Avoid guessable information: don't use names, birthdays, phone numbers or dictionary words.
- Use a password manager: you won't need to remember complex passwords, and they stay safely stored.
- Turn on two-factor authentication: it helps block unauthorized logins even if your password leaks.
- No need to change passwords periodically: forcing regular changes used to be common advice, but it is no longer recommended. Forced changes push people toward simple passwords or small tweaks like changing the last digit, which actually lowers security. What matters is a long, hard-to-guess password that is unique to each service. However, change it immediately if there is evidence of a leak, such as a data breach at the service or a suspicious login.
Sources
- NIST (U.S. National Institute of Standards and Technology), "SP 800-63B Digital Identity Guidelines: Authentication and Authenticator Management", 3.1.1.2 Password Verifiers
- Ministry of Internal Affairs and Communications, Japan, "Setting and managing secure passwords" (Japanese)
Frequently asked questions
Are generated passwords stored or sent anywhere?
No. Passwords are generated entirely in your browser and are never sent to or stored on any server.
How long should my password be?
For most online services, use at least 16 characters including uppercase, lowercase, numbers and symbols. For critical accounts such as banking or admin access, 20 or more characters is recommended.
Should I change my passwords regularly?
No, periodic changes are not necessary. NIST (U.S. National Institute of Standards and Technology) and Japan's Ministry of Internal Affairs and Communications both advise against forced periodic changes. Use a strong, unique password for each service and change it immediately if there is evidence it has been leaked.
How secure is the random number generator?
It uses the browser's built-in cryptographically secure random number generator (crypto.getRandomValues from the Web Crypto API).
What if a service doesn't allow symbols?
Choose the Medium strength level, or uncheck Symbols in Advanced settings. Use a longer password to keep it strong.