Scrawlspace › Developer Utilities

Strong Password & Passphrase Generator

Create strong random passwords, memorable passphrases from the EFF wordlist, or PINs. They are generated in your browser with crypto.getRandomValues, a cryptographically secure random source, and nothing is sent or stored. A meter shows each one's entropy in bits and how long it would take to crack.

How to use Password Generator

1. Pick a Type: Password, Passphrase or PIN.
2. For a password, set the Length (up to 128) and the Characters; for a passphrase, the number of Words (3 to 12), the Separator, and whether to Capitalise or Add a digit.
3. Optionally tick No look-alikes or No brackets or quotes, or list characters to exclude for sites that reject some symbols.
4. Check the strength meter, then Copy the password, or set How many and Copy all.

Frequently asked questions

How long should a strong password be?

For a random password, 16 characters from all four sets gives about 105 bits, far beyond any guessing attack. For a passphrase, 5 EFF words give about 65 bits and 6 words about 78 bits. The two are not equivalent: 5 words is about as strong as 10 random characters. For a passphrase that needs to match a strong password, use 6 or more words; 6 words is close to a 12-character random password (about 79 bits).

Is a passphrase better than a password?

A passphrase is easier to remember and type, but each word adds only about 12.9 bits, so it needs more words than a password needs characters. Use passphrases for things you type by hand, such as a password manager's master password, and long random passwords for everything stored in a manager.

How is the crack time estimated?

It is the average time to guess the password at 10 billion guesses a second, which models a fast offline attack on a leaked, weakly hashed password. Online logins are far slower to attack, so treat it as a worst case.

What if a site won't accept symbols or long passwords?

Untick !@#$, or type the rejected characters into Exclude characters, and set the length to the site's maximum. Each removed character set lowers the bits shown, so add a few characters to make up for it.

Is this password generator safe?

Passwords are made in your browser with crypto.getRandomValues, using rejection sampling so every character is equally likely. Nothing is sent or stored. Sites, for their part, should store passwords with a slow, salted hash, not a fast one like those in the hash generator.

What is the EFF wordlist?

A list of 7,776 common, easy-to-spell words published by the Electronic Frontier Foundation for generating passphrases. 7,776 is 6^5, so each word can also be picked with five dice rolls.

How strong is it?

Entropy is the number of guesses an attacker who knows your settings must make, written as a power of two. A random password has length × log2(pool size) bits: all four sets give a pool of 94 characters, about 6.55 bits each. A passphrase has about 12.9 bits per EFF word. Crack times are averages at 10 billion guesses a second. The meter calls 60 bits Strong and 80 bits or more Very strong.

Why random beats clever

Substitutions such as P@ssw0rd, keyboard patterns and words with a year on the end are in every cracking dictionary, so they are far weaker than their length suggests. Only randomness counts. NIST SP 800-63B, the US guidance for authentication, tells sites to allow long passwords (at least 64 characters), to check new passwords against lists of breached ones, and not to force composition rules such as one symbol and one digit.

Use a different password for every site, keep them in a password manager, and turn on two-factor sign-in where it's offered. A strong password reused on a breached site is no longer strong. To lock a PDF with a generated password, use Protect PDF.