Random password and passphrase generator

Generate a unique password for a new account, replace a reused login, or create a random-word passphrase you can type more easily. Start with 24 random characters or six randomly selected words, then adapt the result to the service you use.

What makes a generated password strong?

A strong password is long, unpredictable, and used for only one account. Replacing a with @ in a familiar word does little to hide it from guessing software. Random generation avoids personal details, keyboard patterns, and the small set of phrases people tend to choose.

Choose random characters when a password manager will fill in the login for you. Choose a random-word passphrase when you need to remember or type it, such as when unlocking a password vault. A passphrase gets its strength from independently selected words, not from forming a clever sentence. A quotation or lyric is a poor substitute.

Our guide to choosing a strong password compares examples, explains why length can beat complexity, and shows how guessing-time estimates depend on the attack.

Which password settings should I use?

The short-word list makes individual words easier to type, but contains fewer choices. Eight short-list words give a similar guessing space to six long-list words. Changing a fixed separator or capitalizing every word improves readability without adding randomness. Keep all the randomly selected words, including repetitions; editing a phrase into a meaningful sentence can make it more predictable.

Save it in a password manager

A generator creates a secret; a password manager stores it with the correct website and username. These established options cover different preferences:

• Bitwarden  offers an open-source password manager with a free personal tier and access across devices.
• 1Password  offers paid individual and family plans, useful when you want managed syncing and household sharing.
• Proton Pass  combines password storage and autofill with email aliases, with free and paid plans.
• KeePassXC  is a free, open-source desktop manager for Windows, macOS, and Linux. It stores an encrypted database file; you arrange its backups and any syncing you want.

Choose one that works on the devices you actually use. Protect its vault with a unique passphrase, follow its recovery instructions, and enable multi-factor authentication where available. Most managers also include their own generator, convenient when creating an account directly.

Save the new password and confirm that the account accepts it before closing this page. Generating a result does not change any account password. This tool keeps no saved vault or password history. A downloaded text file is unencrypted; move the credential into secure storage and remove unnecessary copies. Clearing the page does not erase clipboard history or downloaded files.

Passwords for Apache and guest Wi-Fi

For a protected website directory, use your result in the htpasswd generator, then install the entry and configure your server. A random password is the original secret; an htpasswd entry stores a hash. The bcrypt option in that tool accepts at most 72 UTF-8 bytes.

For guest Wi-Fi, first change the network password on the router, then make a Wi-Fi QR code so guests can scan it. The Wi-Fi tool’s WPA/WPA2 option accepts 8-63 UTF-8 bytes. This generator uses ASCII characters and words, so each character takes one byte; long passphrases can still exceed either limit.

If you are testing HTTP authentication, the cURL command builder helps assemble the request. A generated password is not an API token: use credentials configured or issued by the destination service. Related-tool links do not transfer your generated secrets.

How random is the result?

The browser’s cryptographic random-number generator  supplies the randomness. Character passwords are sampled uniformly from the combinations allowed by your settings, including required character types. Words are selected independently. If secure randomness is unavailable, generation stops.

The bits of generated randomness count the possible results for the current settings, rounded down: one extra bit doubles the possibilities. This describes generated results, not a password you invent, and does not predict how long a real account will resist an attack. Reuse and phishing can bypass password guessing entirely.

The word lists are adapted from EFF’s passphrase lists , created by Joseph Bonneau under Creative Commons Attribution 4.0 . We remove dice labels and omit four hyphenated entries from the long list and one from the short list, leaving 7,772 and 1,295 words. Remaining spellings are unchanged. This keeps separators distinct from words; the lists are bundled with the tool.

Learn more

• How to choose a strong password or passphrase - practical examples, common mistakes, and account protection.
• Check website network requests - inspect browser activity using harmless sample data.
• EFF’s password safety guide  - unique credentials, password managers, and random passphrases.