Password Generator
Generate cryptographically strong passwords, passphrases and PINs. What you generate stays in your browser.
Characters entered here will be excluded from the generated password
Generated in your browser. This page does not send the passwords, passphrases or PINs it makes to our servers.
Password, passphrase and PIN FAQ
Password, passphrase or PIN: which should I use?
Use a password for anything a password manager fills in for you. Use a passphrase when a person has to type or remember it, such as a password manager's own master password or a disk-encryption password: five random words are about as strong as a random 10-character password and much easier to type. Use a PIN only where the number of attempts is limited, such as a phone or a card.
How strong is a passphrase?
Each word is picked at random from the EFF long word list of 7,776 words, so each adds about 12.9 bits. Five words give about 65 bits, and seven give about 90. Capitalizing every word does not add strength, because it is not random; adding a number to one random word adds about 5 to 7 bits.
Why is a PIN rated weak?
Each digit adds only about 3.3 bits, so a 6-digit PIN has about 20 bits, a million possibilities. That is fine when a device locks after a few wrong tries, and not enough anywhere an attacker can guess without limit.
Is the randomness fair?
Every character, word and digit comes from your browser's cryptographic random number generator (crypto.getRandomValues), with rejection sampling so that no character or word is more likely than another.
Is the generated value sent anywhere?
No. It is generated in your browser, and this page does not send what it generates to our servers or anyone else. If you accept analytics cookies, the page reports visits, not the values you generate.
Now share it securely
Generated a strong password? Don't send it over Slack or email. Use CredenShare to deliver it with AES-256 encryption and automatic expiration.