Password generator
Create a random password or passphrase and see how strong it is. Everything runs in your browser.
Nothing leaves your browser: passwords are generated and checked on this page only.
How it works
Passwords are built from the character types you choose using your browser’s cryptographic random number generator. Every character is equally likely. If one of the chosen types is missing, the whole password is drawn again rather than patched, so the result stays unbiased. Passphrases are made of words picked at random from a built-in list of more than 3,800 common English words.
Reading the result
Entropy is the number of bits an attacker must guess if they know exactly how the password was made. Each extra bit doubles the work. Around 60 bits is strong for most accounts and 80 or more is very strong. The time shown assumes an offline attack on a stolen password database at 10 billion guesses a second. Real attacks are often slower, but it is a sensible worst case.
Checking your own password
The checker cannot know how you chose your password, so it estimates. It looks for common passwords, dictionary words, sequences, repeats, keyboard patterns, years and dates, and counts what remains. Treat the result as a guide: a password that scores well can still be weak if you have used it elsewhere.
Questions
Is the generated password sent anywhere?
No. It is created in your browser and never leaves it. The same goes for the password you check.
Should I use a password or a passphrase?
With a password manager, use long random passwords. For the few you must remember, such as the manager’s own password, use a passphrase of six or more random words.
How long should a password be?
NIST SP 800-63B-4 asks for at least 15 characters when a password is the only factor and at least 8 with multi-factor authentication. Longer is better.
Why avoid look-alike characters?
I, l, 1, O and 0 are easy to confuse when you read or type a password by hand. Leaving them out lowers the entropy slightly, and the figure shown accounts for that.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Consulting and trainingRelated articles
-
Passwords and passkeys - what NIST SP 800-63B-4 recommends
NIST's current password rules explained - 15-character minimums, no forced rotation, breached-password checks - plus MFA strength and where passkeys fit.
-
JWT security pitfalls and how to avoid them
Common JWT mistakes - alg none, RS256 and HS256 confusion, weak HMAC secrets, missing claim checks, kid injection, revocation and storage - and the fixes.
-
EUDI Wallet logins: what to check before you accept them
Questions for municipalities and service providers on assertions, attributes and signing flows before they accept EUDI Wallet logins.