LMPB Tools

Password Generator

Generate strong random passwords and memorable passphrases. Choose length and characters; see entropy and crack time. Never stored or sent.

Create strong, random passwords in one click — or memorable passphrases made of real words, such as Correct-Horse7-Battery-Staple. Choose the length and which characters to use, leave out look-alike characters, and see right away how strong the result is and how long it would take to crack.

Passwords are generated by your browser's cryptographically secure random number generator, on your device. They are never stored, logged or sent anywhere.

How to use Password Generator

  1. Choose Password or Passphrase.
  2. For a password, set the length (16 or more is recommended) and the character types. For a passphrase, choose the number of words (6 is a good default).
  3. Check the strength meter and estimated crack time; click Generate for a new one.
  4. Click Copy and save it in your password manager.

Features

  • Cryptographically secure randomness (crypto.getRandomValues) with no modulo bias — every character is equally likely.
  • Length from 4 to 128 characters; upper case, lower case, digits and symbols.
  • Leave out look-alikes (I, l, 1, O, 0) or any characters a website does not accept.
  • “At least one of each” without weakening the randomness.
  • Passphrases from the EFF large wordlist (7,776 words), with separator, capitals and a number.
  • Entropy in bits, a strength meter and an honest crack-time estimate.
  • Generate up to 50 at once and download them.
  • Nothing is stored or sent; works offline once loaded.

What makes a password strong?

Strength comes from unpredictability, measured in bits of entropy: each extra bit doubles the number of guesses an attacker needs. A random password's entropy is its length × log2(number of possible characters). Length matters most — adding characters helps far more than adding symbol types.

PasswordEntropyTime to crack*
8 lower-case letters38 bitsabout 1 second
8 characters, all 4 types52 bitsabout 5 hours
12 characters, all 4 types78 bitsabout 39,000 years
16 characters, all 4 types104 bitsabout 2 trillion years
4-word passphrase52 bitsabout 5 hours
6-word passphrase78 bitsabout 35,000 years

Passwords vs passphrases

A passphrase is several random words, like timber-galaxy-oyster-velvet-plank-sunny. Each word from the 7,776-word EFF list adds about 12.9 bits, so six words give about 78 bits — as strong as a random 12-character password — but much easier to type and remember. Use passphrases for things you must type yourself (your computer login, your password manager's master password) and long random passwords for everything stored in a password manager.

The words must be chosen randomly by a computer, not by you: phrases people pick themselves, such as song lyrics, are guessed quickly.

How the crack time is estimated

*The estimate assumes the attacker knows exactly how the password was generated and can try 100 billion guesses per second — possible with graphics cards against a database of fast, poorly stored password hashes. On average they need to try half of all possibilities. Online logins, which allow only a few attempts, are far slower to attack. Real attacks try common passwords first, which is why a random password is so much stronger than a clever-looking one you made up.

Password tips

Use a different password for every account — when one website is breached, attackers try the same email and password everywhere else. Store them in a password manager, which can also fill them in for you. Turn on two-factor authentication for important accounts such as email and banking. Never reuse a password you have used before, and change passwords that appear in a data breach.

Frequently asked questions

Is this password generator safe?

Yes. Passwords are created in your browser with its cryptographically secure random number generator. They are never sent over the internet, stored or logged — you can even disconnect after the page has loaded.

How long should my password be?

At least 16 characters for random passwords stored in a password manager, and at least 6 words for passphrases you need to remember. Longer is always better, as long as the website accepts it.

What are look-alike characters?

Characters that are easy to confuse when reading or typing, such as capital I, lower-case l and the digit 1, or capital O and zero. Leave them out if you need to read the password aloud or type it from paper.

Why do some websites reject symbols?

Some sites allow only certain symbols. Type the characters they refuse into “Characters to leave out”, or untick symbols and make the password a little longer to keep the same strength.

Is a passphrase really as secure as a random password?

Yes, when the words are chosen randomly. Six random words from a 7,776-word list have about 78 bits of entropy, similar to a random 12-character password using all character types.

Does “at least one of each” make passwords weaker?

Only negligibly. The generator draws a fully random password and simply draws again if a chosen character type is missing, so every allowed password is still equally likely.

Where does the word list come from?

From the Electronic Frontier Foundation's large diceware wordlist (7,776 words chosen to be easy to type and remember), used under the CC BY 3.0 US licence.

Related tools