Select at least one character set
Passwords are generated on your device and never sent anywhere, so save the ones you use in a password manager.
Random PINs of 4 to 12 digits, each digit drawn without bias. A 4-digit PIN has 10,000 combinations and a 6-digit PIN 1,000,000, so pick the longest your bank card or phone allows and skip birthdays and runs like 1234.
How to use
- Pick Password, Passphrase or PIN.
- Set the length with the slider or type a number. For passwords, choose which characters to use.
- Tap the big result to copy it. Press Generate (or R) for a fresh one.
- Below it you get more suggestions: tap any of them to copy it instead.
- The meter shows the strength in bits and how long an attacker would need to guess it.
- Everything is generated in your browser with crypto.getRandomValues and rejection sampling, so every character is equally likely. Passwords are never sent or stored; only your settings are remembered.
- Crack time assumes an offline attack on a fast hash at 10 billion guesses per second. Aim for 80 bits or more for important accounts.
- “Use every set” guarantees at least one character from each selected group, which many sites require. “No look-alikes” removes I, l, 1, O, 0 and o.
- Passphrases use the EFF Large Wordlist (7,776 words, about 12.9 bits per word) by the Electronic Frontier Foundation, licensed CC BY 3.0 US. Six words give 77 bits and are easy to type and remember.
- Use a different password for every account and keep them in a password manager.
How strength is measured
Strength is entropy: length × log2(size of the character set). With upper and lower case, digits and the 25 symbols offered here, the set has 87 characters, about 6.44 bits each. A 12-character password gives 77 bits, 16 characters 103 bits and the default 20 characters 129 bits.
The crack time assumes an offline attacker trying 10 billion guesses per second against a fast hash. At that rate 80 bits takes millions of years to exhaust, while 40 bits falls in under two minutes. Aim for at least 80 bits for email, banking and password-manager master passwords.
Password, passphrase or PIN
Random characters pack the most strength into the fewest characters and suit a password manager. Passphrases use the EFF Large Wordlist of 7,776 words, about 12.9 bits per word: six words give 77 bits and are easy to type on a phone. PINs are for devices and cards that only take digits; a 6-digit PIN has 1,000,000 combinations, so it relies on lockouts after a few wrong tries.
Common mistakes
Reusing one password on several sites is the biggest risk, because one breach unlocks the rest. Predictable changes such as Summer2025! to Summer2026! add almost nothing. Length beats complexity rules, and No look-alikes (dropping I, l, 1, O, 0, o) helps only when you must read a password aloud or type it by hand.
Frequently asked questions
How long should a password be?
At least 16 random characters, or 6 passphrase words, for important accounts. Both give roughly 80 bits or more. If a site limits length, use the maximum it allows.
Is it safe to generate passwords online?
Here, yes: passwords are created in your browser with crypto.getRandomValues and are never sent over the network or saved. Only your settings, such as length and character types, are remembered.
Are passphrases as secure as random passwords?
Per character they are weaker, but per bit they are equal. Six random words from the 7,776-word EFF list give about 77 bits, close to a 12-character random password, and are much easier to remember.
What does Use every set do?
It guarantees at least one character from each selected group, such as one digit and one symbol, which many sign-up forms require. The remaining characters are still drawn at random.
How secure is a 4-digit PIN?
A 4-digit PIN has only 10,000 combinations, about 13 bits, so it is safe only where the device locks after a few wrong attempts. Use 6 digits or more when you can, and avoid dates and repeated digits.
Do I need to change my passwords regularly?
Not on a fixed schedule. Current guidance such as NIST SP 800-63B recommends changing a password when there is evidence it was exposed, and otherwise using long, unique passwords stored in a password manager.