Updated · Built and checked by the PlinzoTools team, formulas tested against published sources
Generate a strong random password or a memorable passphrase, with options to exclude look-alike characters.
Generating...
This tool creates strong random passwords and passphrases using the Web Crypto API's cryptographically secure random number generator -- not the predictable Math.random() some generators use. In Password mode you choose the length and character sets, with an option to leave out look-alike characters. In Passphrase mode it strings together random words from the EFF's 7,776-word list -- easier to type and remember, and just as strong at the right length. Each result shows its entropy and how long an offline attack would take on average.
Pick a mode. For a password, set the length and tick the character sets you want, plus "Exclude look-alike characters" if you'll ever read or type it by hand. For a passphrase, choose the number of words, a separator, and whether to capitalize each word or add a number. A new result appears whenever you change an option; "Generate New" re-rolls with the same settings. Copy or download the result before changing settings.
Password: one character is drawn from each selected set, the rest of the length is filled from all selected sets combined, and the result is shuffled. Entropy = log2(pool size) × length.
Passphrase: each word is drawn independently from 7,776 words, so each adds log2(7776) = 12.92 bits. Entropy = 12.92 × number of words, plus log2(10) + log2(words) if a number is added.
Entropy, in bits, measures the size of the space an attacker has to search: every extra bit doubles it. These figures are exact for this generator, because every character or word really is chosen at random. As a rough guide, 60 bits resists online attacks comfortably, 80 bits resists determined offline attacks, and 100+ bits is beyond any practical brute force. A 16-character password with all four sets is about 101 bits; a six-word passphrase is about 78 bits.
To see how strong an existing password really is, try the Password Strength Checker.
Password entropy = log2(pool) × length. Passphrase entropy = 12.92 × words (+ 3.32 + log2(words) with a number).
Passphrase words come from the Electronic Frontier Foundation's large wordlist, published in 2016 under a Creative Commons Attribution licence. It was designed for random passphrases: 7,776 common, concrete words, without profanity or words that are hard to spell. Its size is 6 to the fifth power, so it also works with physical dice -- five rolls pick one word. The tool uses the list unmodified.
Entropy figures are only meaningful when every choice is truly random, and here they are: each character or word is drawn with a secure random generator and rejection sampling, so no value is more likely than another. One small caveat for Password mode: guaranteeing one character from each selected set slightly narrows the possibilities compared with fully independent draws, so the figure is a very slight overestimate. The difference is a fraction of a bit for normal lengths. That's very different from a password a person makes up, where the same formula can overstate strength enormously -- which is what the Password Strength Checker's pattern detection is for.
Use a different password for every account and store them in a reputable password manager. Turn on two-factor authentication wherever it's offered. Don't send passwords by chat or email, and don't reuse one that has appeared in a screenshot or screen share. If your employer or a service has its own password policy, follow it.
Yes. It uses crypto.getRandomValues(), a cryptographically secure random source, with rejection sampling so every character and word is exactly equally likely. Generation happens in your browser and nothing is sent or stored anywhere.
Both are strong at the right size. Random character passwords pack more strength into fewer characters, which suits a password manager. Passphrases are far easier to remember and type, which suits the handful of passwords you have to enter yourself.
For a random password, 16 characters is a solid baseline. For a passphrase, use at least six words; EFF recommends six for most uses. Longer always helps more than adding another character type.
One character is drawn from each selected set before the rest are filled in and shuffled, so the result passes common rules such as "must contain a digit and a symbol".
Not meaningfully. Capitalizing every word is a rule an attacker can simply apply, so the tool doesn't add anything to the entropy for it. Adding words is what makes a passphrase stronger.
Yes, if the site allows spaces in passwords. Most modern sites do; if one doesn't, choose a hyphen or a period.
Every change to the options generates a new result straight away, so copy the one you want before adjusting settings.
Reference: MDN Web Docs