Password Generator
Create strong random passwords or easy-to-type passphrases with your device's secure random generator. Nothing is sent anywhere.
Runs 100% in your browser
- · about 0 bits of entropy
Weak and reused passwords are still one of the most common ways accounts get broken into. This free Password Generator creates long, truly random passwords and memorable passphrases in a second, using the same cryptographic random number generator your browser uses for secure connections. Every password is made on your device and is never sent, saved or logged.
How to use the password generator
- Choose a type. Pick Random characters for the strongest password per character, or Passphrase for something you can read and type easily.
- Set the length. Drag the slider. 16 characters or 5 to 6 words is a good default for most accounts.
- Pick character sets. Keep all four on unless a website rejects symbols. Turn on Avoid look-alikes if you will ever read the password aloud or type it from paper.
- Copy and save it. Press Copy and paste the password straight into your password manager, or pick one of the five alternatives below.
What makes a password strong?
A password is strong when an attacker cannot guess it in any realistic amount of time. That depends on two things: how many possible passwords your settings allow, and whether yours was picked at random from all of them. Security engineers measure this as entropy, in bits. Each extra bit doubles the number of guesses needed. For a random password the formula is simple: entropy = length × log2(number of possible characters).
With lowercase, uppercase, digits and the 25 symbols this tool uses, each character can be one of 87 options, which adds about 6.4 bits per character. A random 16-character password therefore carries about 103 bits of entropy. Even an attacker trying a hundred billion guesses per second would need far longer than the age of the universe to try a meaningful fraction of the possibilities. An 8-character password from the same set has only about 52 bits, which well-equipped attackers can exhaust offline in hours or days if a site's password database leaks.
The meter above the button uses these thresholds: under 40 bits is weak, 40 to 59 is fair, 60 to 79 is strong and 80 or more is very strong. It only measures the randomness of what this generator made; it cannot judge a password you invented yourself, because human-chosen passwords are far more predictable than their length suggests.
Length beats complexity
Modern guidance has moved away from forcing odd symbols and frequent changes. The US National Institute of Standards and Technology (NIST) Digital Identity Guidelines, SP 800-63B, which many organisations worldwide use as a reference, tell services to require a minimum length (15 characters when a password is the only factor), to allow long passwords of at least 64 characters, to accept all printable characters and spaces, and to stop forcing periodic changes unless there is evidence of compromise. The UK National Cyber Security Centre recommends a similar idea for people: three random words joined together. The reasoning is that length adds more security, and is easier for humans, than squeezing in a symbol.
Random passwords vs passphrases
| Setting | Approx. entropy | Best for |
|---|---|---|
| 12 random characters (all sets) | 77 bits | Sites with short maximum lengths |
| 16 random characters (all sets) | 103 bits | Default for a password manager |
| 20 random characters (all sets) | 129 bits | Email, banking, admin accounts |
| 4-word passphrase (this list) | 30 bits | Low-risk logins only |
| 6-word passphrase + number | 51 bits | Things you must type by hand |
| 8-word passphrase | 59 bits | Device or password-manager master password |
The passphrase list in this tool has about 170 short, common English words, so each word adds about 7.4 bits. Larger lists such as the EFF long wordlist (7,776 words, about 12.9 bits per word) give more strength per word. If you need a passphrase you will type every day, use at least six words here, or combine a passphrase with two-factor authentication.
How this tool keeps your password private
- Cryptographic randomness. Characters are chosen with
crypto.getRandomValues, the Web Crypto API that browsers provide for security-sensitive code, rather thanMath.random, which is not designed to be unpredictable. - No bias. The tool uses rejection sampling, so every allowed character has exactly the same chance of appearing. It also guarantees at least one character from each set you ticked, then shuffles the result.
- Nothing leaves your device. There is no server step. You can even load the page, switch off your connection and keep generating.
Good password habits
- Use a different password for every account. When one site is breached, attackers try the same email and password on other sites, an attack called credential stuffing.
- Let a password manager remember them. Built-in managers in browsers and phones, or dedicated apps, can store hundreds of unique passwords behind one strong master passphrase.
- Turn on two-factor authentication or passkeys wherever they are offered, especially for email, which can reset all your other accounts.
- Check if you have been exposed. Services such as Have I Been Pwned list known data breaches so you know which passwords to change first.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created inside your browser with the Web Crypto API and are never transmitted or stored by WorldScope. Closing the tab erases them. For extra peace of mind you can disconnect from the internet after the page loads.
How long should my password be?
For an account protected only by a password, use at least 15 to 16 random characters, which matches current NIST guidance. Use 20 or more for your email and financial accounts. If a site limits length, use the maximum it allows.
Are passphrases safer than random passwords?
Per character, random passwords are stronger. Passphrases are easier to remember and type, so they work well for the few passwords you cannot store in a manager. Use enough words: six or more from this list.
Why does a website reject my password?
Some sites still block certain symbols or limit length. Untick Symbols or shorten the length, then generate again. The strength meter shows what you are giving up.
Should I change my passwords regularly?
Not on a schedule. Current guidance says to change a password when there is a sign it was exposed, such as a breach notice, rather than every few months.
What does entropy mean?
Entropy, measured in bits, describes how many guesses an attacker would need. Every extra bit doubles the work, so 80 bits is about a million times harder to crack than 60 bits.
Sources
- NIST SP 800-63B Digital Identity Guidelines: Authentication
- NCSC: Three random words
- MDN: Crypto.getRandomValues()
- EFF Dice-Generated Passphrases
Related tools
By Abdullah Al-Janoubi · WorldScope Tools · Updated October 2026
Comments