Security
Password Generator
Generate secure passwords, easy-to-remember passphrases from English words or PINs – with cryptographically secure randomness right in your browser and exactly calculated strength. Plus: check your own password.
- Runs entirely in your browser
- No data upload
- No sign-up
- Free
Generate password
More options
Check your own password
not sent anywhereRough estimate: a program cannot know whether a password has already been used elsewhere or leaked. For important accounts, always use a randomly generated, unique password.
Guide
How it works
- Choose a type
“Password” for maximum security with few characters, “Passphrase” for something you can remember and type easily, “PIN” for numeric codes.
- Configure
Set the length and character types. The indicator below instantly shows how strong the result is – in bits and as the estimated time an attack would need.
- Use it
Copy it with one click – ideally straight into a password manager. The space bar or “New” creates a new one instantly.
- Optional: check
Below you can enter an existing password and find out whether it has typical weaknesses. This also happens only in your browser.
FAQ
Frequently asked questions
How long should a password be?
For online accounts at least 12, better 16 characters from all character types. For password managers, Wi-Fi or encrypted files, rather 20 characters or more. Length matters more than symbols: every additional character multiplies the number of possibilities.
What does “bits” mean for strength?
Bits describe how many possibilities an attacker would have to try: 60 bits are 2⁶⁰ ≈ one quintillion combinations, and every additional bit doubles that. From about 64 bits a random password is considered strong, from 90 bits very strong. The value is calculated exactly – but it only applies to randomly generated passwords like the ones here.
Are passphrases secure?
Yes, if the words are chosen at random – as here. Six words from the list give about 60 bits, a little more with an added digit. Self-invented sentences or song lyrics, on the other hand, are easy to guess.
Are the passwords really not sent?
No, they are not. They are created with crypto.getRandomValues(), your browser’s secure random number generator, and never leave your device. There is deliberately no “Share link” so that no password ends up in your browser history.
How do I remember so many passwords?
You don’t – that is what password managers like Bitwarden, KeePassXC or the ones built into browsers and operating systems are for. You only need to remember one strong master password, ideally a passphrase. In addition, turn on two-factor authentication wherever possible.
How reliable is the check of my own password?
It is a rough estimate: it detects common passwords, patterns such as “1234” or “qwerty”, years and the “word + number” pattern. It cannot know whether a password has already been leaked. If in doubt: generate a new one.