Password Generator
Strong random passwords and passphrases, generated only on your device.
Generated password
—
Password options
Edit to match a site's rules. The default leaves out quotes, backslash and backtick, which often break scripts and config files.
Passphrase options
Words are chosen at random from the EFF Large Wordlist (7,776 words, each adding 12.9 bits) by the Electronic Frontier Foundation, used under CC BY 4.0 (dice numbers removed; the words are unchanged).
Generate several
Set a number above 1 to create a list (up to 100), one per line.
About the Password Generator
Create passwords that nobody can guess. Every character is picked with your browser's cryptographically secure random number generator (crypto.getRandomValues), using rejection sampling so that every allowed character is exactly equally likely. Choose the length (4–128), which character types to use, which symbols a site accepts, whether to avoid look-alike characters such as 0/O and 1/l, and whether every type must appear at least once.
Prefer something you can type and remember? Switch to Passphrase to string together random words from the EFF Large Wordlist: six words give about 77.5 bits of entropy. The strength meter shows the exact entropy of what you generate and how long a brute-force attack would take. Nothing is sent anywhere or stored — when you close the page, the passwords are gone.
How to use it
- Choose Password or Passphrase. A new one is generated immediately.
- Adjust the length (or number of words) and the character options. The result updates as you change them.
- Check the strength meter, then press Copy — or New password for another.
- To create many at once, set How many (up to 100) and use Copy all or Download .txt.
Examples
r7#Kq2!vLp9@zX4&mN8e
About 130 bits of entropy: 90 possible characters, with every type required. (An example of the format — generate your own.)
trolling-sublease-unbutton-moonwalk-reprint-cosmetics
6 × log₂(7,776) ≈ 77.5 bits. Each word is drawn at random from the 7,776-word EFF list. (An example — generate your own.)
Common uses
- New account passwords to save in a password manager.
- Wi-Fi keys, database and service passwords, and API secrets for configuration files.
- Memorable master passwords or disk-encryption passphrases (use the passphrase mode).
- Batches of temporary passwords for new users or test environments.
What makes a password strong
For a randomly generated password, strength is simply the number of possible passwords, measured in bits of entropy: each extra bit doubles the work for an attacker. Length matters most — adding characters raises entropy faster than adding character types. A 16-character password from letters, digits and symbols has about 104 bits; a six-word passphrase about 77.5 bits.
The strength labels used here are: under 40 bits very weak, 40–59 weak, 60–74 fair, 75–99 strong, and 100 or more very strong. The time shown assumes an attacker who can test a trillion guesses per second against a leaked, fast hash; sites that store passwords properly (Argon2, scrypt, bcrypt) and limit login attempts make attacks far slower.
Current guidance
NIST's Digital Identity Guidelines (SP 800-63B-4) require at least 15 characters for passwords used on their own (8 when they are one part of multi-factor sign-in), ask sites to allow at least 64 characters, and tell them not to impose composition rules or force periodic changes. In practice: use a unique, long, random password for every account, keep them in a password manager, and turn on multi-factor authentication.
The "at least one of each type" and symbol options exist for sites that still enforce composition rules. When they are on, the generator regenerates the whole password until it qualifies, so every valid password stays equally likely.
About the word list
Passphrases use the EFF Large Wordlist by the Electronic Frontier Foundation (Joseph Bonneau, 2016): 7,776 common, easy-to-spell English words, chosen so that no word is a prefix of another. It is used under the CC BY 4.0 licence; the only change is that the dice-roll numbers were removed — the words and their order are unchanged. The list is downloaded with the page only when you open passphrase mode, and words are picked with the same secure random generator.
Limitations
- Passwords are not saved anywhere. Copy them into your password manager before leaving the page.
- Copied passwords stay on your clipboard (and in any clipboard history) until you copy something else.
- Symbols are limited to ASCII punctuation, which almost every site accepts; spaces and non-English characters are not offered.
Privacy
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.
Frequently asked questions
Is it safe to generate passwords on a website?
This page generates them entirely in your browser with crypto.getRandomValues — the same cryptographically secure source password managers use — and never sends or stores them. You can load the page, disconnect from the internet and keep generating.
How long should my password be?
At least 15 characters for passwords you use without multi-factor authentication, per NIST SP 800-63B-4. Random passwords of 16–20 characters, or passphrases of 5–7 words, are a good default; use the maximum a site allows for accounts that matter.
Passwords or passphrases — which is better?
Both are strong when they are random and long enough. Random character passwords pack more entropy per character, which suits a password manager. Passphrases are easier to type and remember, which suits master passwords and anything you enter by hand.
Why are some characters missing from the symbols?
The default set leaves out quotes, backslash and backtick, which often cause trouble in command lines, CSV files and configuration files. You can edit the list to match exactly what a site allows.
What does "avoid look-alike characters" do?
It removes 0, O, o, 1, l, I and |, which are easy to confuse in many fonts — useful for passwords you will read aloud or type from paper. It slightly reduces the number of possible passwords, and the entropy shown accounts for that.