Strong password generator with passphrase mode
Make a random password or a memorable passphrase right in your browser, then see how strong it is in bits and how long it would take to guess.
Runs in your browser. Nothing you enter or open is uploaded.
The short answer
A strong password is long and random. NIST guidance (SP 800-63B) calls for at least 15 characters when the password is the only thing protecting an account, and at least 8 with two-factor authentication. A random 16-character password using letters, numbers and symbols has about 103 bits of entropy, far beyond practical guessing.
How it is calculated
Entropy (bits) = length × log₂(number of possible characters)
Passphrase: words × log₂(2,048) = 11 bits per word
Every extra bit doubles the number of guesses needed.
Worked example
Compare an 8-character and a 16-character password, both using upper and lowercase letters, numbers and symbols (87 possible characters), and a 6-word passphrase.
- 8 characters: 8 × log₂(87) = 51.5 bits; average time to guess at 100 billion tries per second: 4 hours
- 16 characters: 16 × log₂(87) = 103.1 bits; time to guess: longer than the universe has existed
- 6-word passphrase: 6 × 11 = 66 bits; time to guess: 11 years
Doubling the length moved the rating from Weak to Very strong. Length matters more than adding symbols
Quick reference table
| Characters | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|
| Digits only | 26.6 | 39.9 | 53.2 | 66.4 |
| Lowercase | 37.6 | 56.4 | 75.2 | 94 |
| Letters + digits | 47.6 | 71.5 | 95.3 | 119.1 |
| Letters, digits, symbols | 51.5 | 77.3 | 103.1 | 128.9 |
Special cases and common mistakes
- What the rating means: under 40 bits is very weak, 40 to 59 weak, 60 to 79 fair, 80 to 99 strong, 100 and up very strong. The math only holds for a randomly generated password, not one you made up.
- Length beats complexity. 12 lowercase letters (56.4 bits) beat 8 characters using every set (51.5 bits).
- Required "one symbol, one number" rules? When you tick a set, the generator makes sure at least one character from it appears, so sign-up forms accept the result.
- Never reuse a password. One breached site exposes every account that shares it. A password manager remembers them for you.
Frequently asked questions
How long should a password be?
At least 15 characters if the password alone protects the account, per NIST SP 800-63B. With two-factor authentication NIST allows 8, but longer is still better. 16 to 20 random characters is a good default.
Is a 12-character password strong enough?
A random 12-character password with all four character sets has about 77 bits, rated Fair. Fine with two-factor authentication; go to 15+ if it is the only protection.
Is a passphrase better than a password?
For anything you have to type or remember, yes. Six random words give 66 bits and are much easier to type on a phone. Add a number for a few more bits.
Does this site see or save my password?
No. It is generated in your browser with crypto.getRandomValues and never sent anywhere or stored. You can go offline after the page loads and it still works.
Why exclude look-alike characters?
Capital I, lowercase l and 1, and O, o and 0 are easy to misread. Excluding them helps when you read a password aloud or type it from paper, at a small cost in strength.
Should I change my passwords every 90 days?
NIST says services should not force periodic changes. Change a password when there is evidence it was exposed, such as a breach notice.
Sources
- NIST SP 800-63B-4, section 3.1.1.2: Password Verifiers (Last reviewed: October 9, 2026)