Password Generator
Make strong random passwords, easy-to-remember passphrases and PINs, and see how long each would take to crack. You can also check a password you already use.
What “made on your device” means for this tool
When you open this page, your browser downloads the generator itself, the same way any web page loads. From then on, every password is made inside your browser, on your own device, using its built-in secure random number generator (the same one used for encryption). Passwords are never sent to this website's server or to anyone else, and they are not saved.
Checking a password: the password you type in the checker is examined right here in the page. It is not sent anywhere and is forgotten when you leave.
What is saved: only your settings (length, which characters), in this browser, so they are there next time. Never the passwords themselves.
What the server does see: like any website, the server that delivers this page sees basic connection details such as your IP address and which page was requested. Never your passwords.
Visit counting: this site counts visits with privacy-friendly analytics. No cookies, no ads, no tracking across other sites, and your IP address is not stored. It records which page you opened, your country, your device type, how long you stayed and when you copy a result, never the password itself.
More to choose from
How to use the Password Generator
- Pick Password, Passphrase or PIN.
- Set the length and which characters to use.
- Press Copy, or pick one from the list of ten more.
- To test a password you already use, open Check mine.
Questions
What makes a password strong?
Length and randomness. A random 16-character password or a passphrase of five random words would take longer than a lifetime to guess, even with powerful computers.
Is a passphrase as safe as a password?
Yes, if the words are chosen at random. Five random words from the 7,776-word list used here give about 65 bits of randomness, which is very strong, and they are much easier to type and remember.
Are the passwords saved or sent anywhere?
No. They are made in your browser with its secure random number generator and are never sent to this website or stored. Only your settings are remembered.
How is crack time worked out?
From the number of possible passwords with your settings. Fast offline attack assumes 100 billion guesses a second, like a rig of graphics cards against a leaked password file. Online guessing assumes a website that allows about 10 tries a second.
Should I use the same strong password everywhere?
No. If one site is hacked, attackers try that password everywhere else. Use a different password for every account and keep them in a password manager.
Still stuck, or want a tool that isn't here? Ask on the Nebula Discord.