Password Generator

This password generator has three modes. From your words lets you type one or more words you will remember and builds strong passwords around them, keeping your word recognizable while adding random words, digits, symbols and mixed case. Passphrase picks random words from the 7,776-word EFF Large Wordlist. Random password makes strings of 8 to 128 characters from the character sets you choose. Every result shows an honest strength estimate in bits of entropy that counts only the random parts, never your own word. Everything is created in your browser with its secure random generator, and nothing you type or generate is stored or sent anywhere.

How to use the Password generator

1. 1 Choose a modePick From your words to build a password around a word you like, Passphrase for random words only, or Random password for a string that will live in a password manager.
2. 2 Type your word or wordsIn From your words, enter one to five words you will remember. Avoid anything public, such as your name, your pet, your company or your favorite team.
3. 3 Set how much randomness to addChoose how many random words to add (three is the default), or set the number of passphrase words or the password length. More random parts always means more bits.
4. 4 Compare the variants and the strengthEach variant shows its own rating and bit count. The red box shows the weak version people usually make from a word, so you can see what to avoid.
5. 5 Copy it into your password managerCopy the variant you like and save it in your password manager straight away. Press Generate for fresh options, then close the page when you are done.

How to generate a password from a word

People like to generate a password based on a word because a word is easy to remember. That instinct is sound: long passwords made of words are both easier to recall and harder to guess than short strings of symbols. The problem is how most people turn a word into a password. They capitalize it, swap a few letters for look-alike symbols and add a year, and the result is far weaker than it looks.

The From your words mode does it the safe way. You type a word, or several words, and the generator keeps them recognizable but surrounds them with parts chosen by a secure random generator. It produces four variants each time: a passphrase that mixes your word with random words, a random separator and a random two-digit number; a mixed-case version with a random digit or symbol between every word and random capitals inside your own word; your word joined to a block of random characters; and an all lower case version with spaces that is easy to type on a phone.

Your word is placed at a random position among the random words, so an attacker cannot assume it comes first. The separator, the number, the letter case and the extra words are all picked with crypto.getRandomValues. You can add between one and six random words, and the bit count beside each variant updates so you can see exactly what each extra word buys you.

If you prefer to choose several words of your own, such as coffee mountain, type them all. The generator keeps every word you enter and adds random parts around them. Just remember that words you pick together tend to be connected, so they add little on their own.

Why one word with clever swaps is weak

Password-cracking software does not guess one character at a time. It starts with dictionaries of real words, names and passwords leaked in earlier breaches, then applies rules for the changes people commonly make: a capital first letter, a for @, o for 0, i for 1, s for $, and a year or an exclamation mark on the end. That is why P@ssw0rd and Sunsh1ne2026! are among the first guesses tried, however complex they look on screen.

NIST Special Publication 800-63B, the US government guideline for digital identity, tells services to check new passwords against a blocklist that includes previously breached passwords, dictionary words and context-specific words such as the name of the service or the username. A password built from one dictionary word with predictable decoration is exactly what that check is designed to stop.

So the tool treats your own word as known to the attacker and counts it as 0 bits. It also shows the decorated version people usually make from your word, marked as weak, so you can see the difference. The strength of every variant comes from the random words, digits, symbols and letter case the generator adds, not from the word you typed.

What makes a password strong

A strong password is one an attacker cannot work out in any reasonable time, and two things decide that: length and genuine randomness. Every extra random character or word multiplies the number of possibilities. Forced complexity, such as requiring one capital, one number and one symbol, adds far less than people expect, because people satisfy those rules in predictable ways.

NIST SP 800-63B reflects this. In its current revision it asks services to require at least 15 characters when a password is the only thing protecting an account, to allow passwords of at least 64 characters, to accept spaces, and not to impose composition rules such as mandatory symbols. It also says services should not force periodic password changes unless there is evidence a password has been compromised. The Cybersecurity and Infrastructure Security Agency (CISA) gives similar advice to the public: use long passwords or passphrases and a different one for every account.

The other half of strength is uniqueness. Reusing a password means a breach at one website hands attackers the key to every other account that shares it, a technique called credential stuffing. A password manager solves this by creating and remembering a different password for each site, which leaves you with only a few passwords to remember yourself.

Random-word passphrases and the EFF word list

The Passphrase mode, and the extra words in From your words, use the EFF Large Wordlist published by the Electronic Frontier Foundation under a Creative Commons Attribution license. It contains 7,776 words chosen to be easy to recognize and spell, which is the number of combinations of five six-sided dice. Each word picked at random from it adds about 12.9 bits of entropy.

That makes the arithmetic simple. Three random words give about 39 bits, four give about 52, and six give about 78. The UK National Cyber Security Centre popularized three random words as a memorable everyday password, CISA suggests passphrases of four to seven unrelated words, and EFF suggests six words for most uses of its dice method. A sensible rule is four or more words for everyday accounts and six or more for a password manager master password or anything that could face an offline attack.

The key word is random. Words you choose yourself tend to share a theme, such as a hobby, a family name and a year, and attackers model those habits. Letting a secure generator choose removes the bias. You can capitalize each word, pick a separator, use a random digit or symbol between words, or add a number if a website insists on one.

Understanding the entropy estimate

Entropy, measured in bits, counts how many equally likely passwords a method could produce. A password with 40 bits of entropy is one of about a trillion possibilities, and each extra bit doubles that number. For a random password it is the length multiplied by the base-2 logarithm of the number of characters available. For a passphrase it is the number of words multiplied by the logarithm of the word list size, plus anything else chosen at random.

The estimates here are deliberately cautious. They assume the attacker knows exactly how the password was made, including the word list, the length and, in From your words, the word you typed. Only the random choices count. Strength meters on some websites score human-chosen passwords and can be fooled by predictable substitutions; this one measures only the randomness the generator actually added.

The ratings are a guide rather than a guarantee:

• Very weak, under 28 bits: could be guessed quickly. Add random words or length.
• Fair, 28 to 44 bits: acceptable for everyday accounts that limit login attempts, especially with 2-step verification turned on.
• Good, 45 to 59 bits: a solid choice for most online accounts.
• Strong, 60 to 79 bits: suitable for email, banking and work accounts.
• Very strong, 80 bits or more: suitable for a password manager master password, Wi-Fi keys and encryption.

Why secure randomness matters

Not all random numbers are equal. Many simple generators use Math.random, which is designed for games and animations rather than security, and whose output can in some cases be predicted. This tool uses only crypto.getRandomValues, the browser's cryptographically secure random number generator, which draws on randomness collected by your operating system.

It also avoids a subtler mistake called modulo bias. Turning a random number into a choice from, say, 88 characters by simply taking the remainder makes some characters slightly more likely than others. The generator rejects and redraws numbers that would cause that bias, so every character, word, separator and position is equally likely. When several character sets are required, it places one character from each and then shuffles the result with a secure Fisher-Yates shuffle, so the guaranteed characters do not sit in predictable places.

Password managers, 2-step verification and passkeys

Nobody can remember dozens of long, unique passwords, and nobody should try. A password manager stores them in an encrypted vault, fills them in for you and generates new ones. Most browsers and phones now include one, alongside well-known standalone apps, and NIST tells services to allow password managers and pasting. You then only need to remember a handful of passwords: the manager's master password, your device login and perhaps your main email. Those are the right place for a long passphrase or a password built from your own words.

Even the best password can be stolen by a convincing phishing page or malware, so turn on 2-step verification, also called two-factor or multi-factor authentication, wherever it is offered. An authenticator app or a hardware security key is stronger than a text message, but any second step is far better than none. Many services also support passkeys, which replace passwords with a key stored on your device and resist phishing.

For businesses the same principles apply at scale. Give staff a company password manager, require 2-step verification on email, finance and admin accounts, and remove access promptly when someone leaves.

Privacy: nothing is stored or sent

Every password on this page, including the ones built from your own words, is created inside your browser. The words you type are not sent to a server, saved in cookies or local storage, or logged, and nothing is requested from a server when you press Generate. When you close or refresh the page everything is gone, so copy the password you want into your password manager first.

Good habits still apply. Avoid generating passwords on a shared or public computer, clear your clipboard after pasting if others use your device, and never send a password by email or text message. To share a password with a colleague, use the sharing feature in a password manager.

Examples you can copy

Passphrase:                Upward_Auction_Sunshine_87_Seminar   about 53 bits
Mixed case + symbols:      renderer8liquid8SUNShiNE=marina      about 62 bits
Word + random characters:  Sunshine_c)<<1XK                     about 53 bits
Easy to type:              sunshine clasp wool frugality splinter  about 54 bits
Weak, avoid:               Sunsh1ne2026!                        close to 0 bits

Your word + 3 random words + separator + number   about 53 bits
Your word + 5 random words + separator + number   about 80 bits
4 random words from 7,776                        about 52 bits
6 random words                                   about 78 bits
8 characters, all four sets (88 characters)      about 52 bits
16 characters, all four sets                     about 103 bits

Four random words:        Gander-Clasp-Marina-Splinter
Random digit or symbol:   Taste7Wool#Helper=Karate
Random, 16 characters:    r7#Kq2!vXm9;Tb4z

Common mistakes to avoid

Frequently asked questions