Dev & Data
Password & passphrase generator
Choose a length and the characters to include, or switch to a passphrase of random words. Five fresh options are made each time. Nothing leaves your device.
- Free, no sign-up
- Runs in your browser
- Nothing uploaded
Settings
Type
Result
Table
What the password generator makes
It produces five random passwords or five random passphrases every time you change a setting or press Generate again, so you can pick the one that suits the site. A password draws from the character kinds you tick: lowercase, uppercase, digits and the symbols !@#$%^&*()-_=+[]{};:,.?/. A passphrase strings together words from the EFF Short Wordlist, which has 1,296 short English words.
Every character or word comes from your browser's cryptographic random source, using rejection sampling so no choice is favoured. When several kinds are ticked, each password contains at least one of every kind, and the order is shuffled afterwards so those required characters do not sit at the start.
Entropy (bits) = length × log₂(pool size)
Passphrase entropy = words × log₂(1,296), plus log₂(100) if two digits are added
Average crack time = 2bits − 1 ÷ 10,000,000,000 guesses a second
How to use it
- Choose Password or Passphrase.
- For a password, set the length and tick the kinds of character the site allows. Tick "Avoid look-alike characters" if you will read it aloud or type it from paper.
- For a passphrase, set the number of words, a separator, and whether to capitalise words or add two digits.
- Check the strength label and crack-time row, copy one of the five options and save it in your password manager.
Worked example: what length buys you
With all four kinds ticked the pool is 86 characters. A 12-character password scores about 77 bits, labelled Good, with an average crack time of roughly 260 thousand years at 10 billion guesses a second. At 16 characters it rises to about 103 bits, labelled Strong, and the estimate becomes more than a trillion years. Turning on look-alike avoidance drops O, 0, o, I, l and 1 and leaves 80 characters, so 16 characters still give about 101 bits.
A passphrase of five words, such as the shape otter-cedar-blink-pouch-ramp, is about 52 bits, labelled Fair, roughly two days on average at that speed. Six words reach about 62 bits, labelled Good, or around eight years. Adding the two digits to five words gives about 58 bits.
When to use which, and the limits of the numbers
Long random passwords are best for accounts your password manager fills in for you. Passphrases are easier to type and remember, which makes them a good fit for the manager's own master password or a device login, ideally with six or more words.
The crack time models a fast offline attack on a stolen, weakly hashed database. Sites that limit login attempts or use slow hashing are far harder to attack, so treat the figure as a comparison between settings. Strength also assumes the password is used on one account only.
Frequently asked questions
Why does the length have a minimum?
Each ticked kind needs at least one place, so the length must be at least the number of kinds you selected. With four kinds that means four characters, although real passwords should be far longer.
A site rejects some symbols. What should I do?
Untick Symbols and add a few characters of length instead. Each extra character from a 62-character pool adds almost six bits.
Is the example passphrase safe to use?
No, never reuse a phrase printed on a web page, including this one. Generate your own; the five you see are made fresh on your device.
Who made the word list?
The Electronic Frontier Foundation published the EFF Short Wordlist under the CC BY 3.0 US licence. The words are short and easy to type.
Privacy
Your inputs are processed by your browser and are not sent to BeginThings. Generated passwords are not saved by the page, so copy the one you choose before you close it.