Password Generator: a strong password in one second
A random password or a passphrase made of words, with the length and characters you want. See right away how strong it is and how long it would take to crack. Everything happens in your browser: the password never leaves your device.
Strength: very strong
104 bits of entropy
Time to crack: more than a billion years
How strong is the password you already have?
Type a password to see an estimate of its strength and what makes it weaker.
The check runs only on your device. The password is not sent anywhere, not even to us.
Your website's passwords should look like this too
The WordPress admin account, hosting, FTP and your business email are the first passwords attackers try. If you suspect someone already got in, check your website for signs of hacking.
- Made in your browser
- Never sent anywhere
- No sign-up
Time to crack assumes an attack on a stolen database at 10 billion guesses per second. It is an estimate, not a guarantee.
What makes a password truly strong
A password is strong when it is long and completely random. Cracking tools don't guess blindly: they start with leaked passwords, words, names, years and familiar shapes like "Name1985!". Whatever one person thinks of, someone else has thought of too.
That is why the password here comes from your browser's random number generator (crypto.getRandomValues), the same one encryption software uses. Every character is equally likely to appear, and nothing is sent to a server.
How it works
- 1
Pick a password or a passphrase
Random characters for your password manager, or random words for anything you need to remember.
- 2
Set length and characters
8, 12, 16 or 20 characters in one tap, or any length up to 64. Uppercase, lowercase, numbers, symbols.
- 3
See how long it would hold
The entropy in bits and the time an attack would need to find it.
- 4
Copy it
And save it in your password manager. A different password for every account.
Why a strong password matters for a business
Breaches happen every day
When a database leaks, attackers try the same passwords on email, banks and websites. A unique password per account stops the damage there.
Your website is a target
Bots keep trying passwords on every website's /wp-admin. One weak admin password is enough to fill your site with spam.
Email opens everything
With access to your email, someone can reset the password of almost every other account you have. It deserves the strongest password of all.
Three ways to a password nobody can guess
Choose by where you will use it: in a password manager, on a device you type into often, or on paper for someone else.
Random password
For accounts saved in a password manager.
- From 6 to 64 characters
- At least one of every type you choose
- No quotes or spaces that break forms
Passphrase of words
For anything you have to remember or type.
- 3 to 10 random words
- Dash, dot, underscore or space between
- Optional capitals and a number
Check an existing password
To see whether the password you have holds up.
- Common passwords and words
- Runs, repeats and years
- On your device only, nothing sent
About passwords
How many characters should a secure password have?
For an ordinary account, at least 12 random characters. For your email, hosting and website admin, 16 or more. Length matters more than symbols: a random 16-character password is far stronger than an 8-character one full of symbols.
Is it safe to generate a password on a website?
Here, yes, because the password is made inside your browser and is not sent anywhere. You can test it: switch off your internet and press "New", it keeps working. We only record that the tool was used and with which settings, never the password itself.
Password or passphrase: which should I choose?
If you store it in a password manager, take a random password of 16 or 20 characters. If you need to remember or type it often, like your computer login or the password manager's own password, a passphrase of five or six random words is just as hard to guess and much easier to type.
How do I remember so many different passwords?
You don't have to. A password manager such as Bitwarden, 1Password or the one already built into your iPhone and Chrome saves and fills them for you. You remember one, and you turn on two-step verification wherever it is offered.
How accurate is the time to crack?
It is an estimate for the hardest case: an attack on a stolen database at 10 billion guesses per second. On a website's login form, guesses are far slower. The checker spots the best-known patterns, but it cannot know whether your password has already leaked. If it has, it is weak no matter how long it is.
What should I do if I think my website has been hacked?
Change the admin, hosting, FTP and database passwords to new random ones, turn on two-step verification and check the site for the spam and hidden links hackers leave behind.Hacked website check
A strong password. Is your website secure too?
A good password is the start. Up-to-date software, backups and the right server settings keep your website free of spam and lockouts. We can take care of that for you.