Password Generator

Most account breaches start with passwords that are short, reused or easy to guess. This generator makes passwords that are none of those: every character is chosen with your browser’s cryptographic random number generator, with each allowed character exactly equally likely. Choose a password of up to 64 characters from letters, numbers and symbols, or a passphrase of random words that is easier to type on a phone or TV. It shows the entropy — how many guesses an attacker would need — so you can see the effect of length.

1. Choose Password or Passphrase.
2. For a password, set the length and the kinds of characters. At least one of each kind you choose is always included.
3. Turn on “Avoid look-alike characters” if you’ll need to read the password aloud or type it from a screen.
4. For a passphrase, choose the number of words and a separator.
5. Press Copy and save it in your password manager, or press New for another.

• Entropy assumes an attacker knows how the password was made but not the random choices. It doesn’t apply to passwords you edit by hand.
• The passphrase list has 256 common English words, so each word adds 8 bits. Use at least six words for accounts that matter, or a random password for anything high value.
• Some websites limit length or refuse certain symbols. If a site rejects a password, turn off symbols or shorten it rather than choosing a pattern yourself.
• A strong password doesn’t protect against phishing. Turn on two-factor authentication where you can.
• Passwords are generated in your browser with crypto.getRandomValues and are never sent to SmartTools or stored anywhere, including your history or this page’s storage. Copying puts the password on your clipboard; clear it or copy something else afterwards on a shared computer.

For accounts you keep in a password manager, 16 to 20 random characters is plenty. For your password manager’s own master password, use a passphrase of six or more words you can remember.

It depends on the site. This page creates the password with your browser’s own secure generator and has no code that sends it anywhere — you can check the network tab or use it offline. Be wary of any generator that makes passwords on a server.

Words are easier to type and remember. They need more length for the same strength: six random words from this list are about as strong as nine random letters, digits and symbols.

Current NIST guidance says no — change a password when there’s a sign it was exposed. You can check whether a password has appeared in known breaches with the Password Breach Check.