Password Generator

1. Set the length with the slider (16 or more is a good starting point).
2. Choose character types: uppercase, lowercase, numbers, and symbols.
3. Select Avoid similar characters if you'll type the password by hand or read it aloud.
4. Check the strength rating and click Copy. Click Generate another to create a new one.

How to read the strength meter

Strength is measured in bits of entropy: the average number of guesses a brute-force attack would need to crack the password. Each additional bit doubles the work. The time estimate assumes 10 billion guesses per second, the rate of an offline attack using dedicated hardware.

Notice the last row: adding length helps more than adding symbols. If a site doesn't allow symbols, make the password longer.

Passphrases: when to use them and how to make them strong

The Word passphrase option combines English words separated by hyphens and ends with two digits, like Maple-River-Cloud-Train42. It’s easier to remember and type on your phone, but each word comes from a short list and adds only about 6 bits. The number of words is the length divided by 4: the default (16) gives you 4 words, which is still weak. Set the control to 32 (8 words) for a passphrase that’s reasonably strong; for something important, use 48 or more (12 words) and check the bit count shown.

Good password habits beyond the password itself

• Use a different password for every site. Data breaches happen; reusing a password can turn one breach into several.
• Use a password manager to store long passwords, and turn on two-step verification wherever it’s available.
• NIST’s digital identity guidelines (SP 800-63B) favor long passwords over complicated composition rules and recommend that systems block passwords found in lists of breached passwords.