Password Generator
Generate strong random passwords or memorable passphrases.
| Length | 16 characters |
|---|---|
| Character pool | 80 possible characters |
| Entropy | 101 bits |
| Strength | Very strong |
| Offline crack time | longer than the age of the universe |
.yw9K@A4&=dGw@6o #%zvH)2HK5*C&Wrc acC%Lq6B@hBGe8^[ dBH9JP&ne6+=N,S} )#q@Z-Ek2E&UjNT$
Generate strong random passwords, or memorable passphrases made of random words. Every result comes with its actual entropy in bits and a realistic estimate of how long it would survive an offline cracking attempt — so you can judge the strength rather than trust a coloured bar.
Passwords are generated on our server and never stored, logged, or transmitted anywhere else. That said, the most careful approach is to let your password manager generate them locally; this tool exists for when that is not to hand.
How it works
Password strength is measured in entropy — the number of bits of genuine randomness. Each additional bit doubles the work an attacker must do. It is calculated from the size of the character set and the length, not from whether the result happens to look complicated.
This is why P@ssw0rd! is weak despite hitting every "complexity
requirement": the substitutions are entirely predictable, and cracking tools try
them first. A password's strength comes from how it was chosen, not how it looks.
Two ways to reach a strong result:
- Random characters. 16 characters from a mixed set gives roughly 100 bits — far beyond any feasible attack. Impossible to memorise, which is fine, because it belongs in a password manager.
- Passphrases. Strength comes from the size of the word list and the number of words, not from the phrase sounding unusual. Our passphrases draw on the EFF Short Wordlist of 1,295 words, so each word contributes about 10.3 bits: six words give roughly 62 bits, seven give 72. Crucially the words must be chosen randomly — a phrase you thought of yourself is far weaker than it looks, because human choices cluster.
Guidance has changed: NIST no longer recommends forced periodic rotation or arbitrary composition rules, because both push people toward predictable patterns. Length, uniqueness per site, and a password manager matter far more.
Passphrase words come from the EFF Short Wordlist #1, by the Electronic Frontier Foundation, used under CC BY 3.0 US.
Frequently asked questions
Is it safe to use a password from a website?
Generating in your own password manager is always safest, since nothing leaves your device. Here, passwords are produced with the operating system's cryptographic generator and are never stored or logged — but if you are being maximally careful, treat any web-generated password as a starting point and change a few characters.
How long should my password be?
At least 16 random characters for anything important, which is roughly 100 bits of entropy. For a passphrase, six or more randomly chosen words. Below about 12 characters, offline cracking becomes realistic for a determined attacker.
Are passphrases really as strong as random passwords?
They can be, but only when the words are chosen randomly from a large list and you use enough of them. Four words from a small list is weaker than it looks. The advantage is memorability, not raw strength.
Should I change my passwords regularly?
No. NIST dropped that advice because forced rotation leads people to make small predictable changes. Change a password when there is a reason: a breach, a shared credential, or any suspicion of compromise.
What does "exclude ambiguous characters" do?
It removes characters that are easy to confuse when read or typed by hand — 0 and O, 1 and l and I. It slightly reduces entropy, which the strength figure accounts for. Useful for passwords you must dictate or type from paper.
Why does the crack time estimate vary so much elsewhere?
Because it depends entirely on assumed attack speed. Our estimate assumes an offline attack at 100 billion guesses per second against a fast hash, which is a realistic worst case for modern GPU hardware. A properly bcrypt-hashed password would take vastly longer.
Related tools
Password Strength Checker
Test the entropy and brute-force resistance of your passwords.
SecurityPwned Password Checker
Check if a password has been exposed in a data breach (using secure k-anonymity).
SecurityBcrypt Generator & Verifier
Hash a password with bcrypt or Argon2, or check one against a hash.
SecurityUUID Generator
Generate UUID v4, time-ordered UUID v7, or ULIDs in bulk.
Developer Utilities.htpasswd Generator
Create Apache basic-auth credentials in bcrypt, APR1 or SHA-1.
SecurityHash Generator
Generate MD5, SHA-1, SHA-256, SHA-512, SHA-3 and CRC32 hashes at once.
Developer UtilitiesNeed hosting that just works?
Free SSL, daily backups and 24×7 support on every Loudhost plan.