Password Generator
Generate cryptographically secure passwords, passphrases and PINs instantly in your browser.
- Use at least 16 characters for sensitive accounts
- Include symbols and numbers to expand the character space
- Never reuse passwords across different services
- Store in a password manager like Bitwarden or KeePass
- Enable two-factor authentication wherever possible
- Easier to remember than random character strings
- Based on the EFF Large Wordlist — proven cryptographic strength
- 4 words provide ~51 bits of entropy — enough for most uses
- 6+ words give 77+ bits — excellent for master passwords
- Each additional word multiplies possible combinations
- 4-digit PIN: 10,000 possible combinations
- 6-digit PIN: 1,000,000 possible combinations
- All PINs use cryptographically secure randomness
- Avoid sequential numbers (1234) or repeated digits (1111)
- Use longer PINs for device encryption
Your password is analyzed entirely in your browser. It is never sent anywhere.
- Entropy calculation based on character set used
- Common keyboard patterns (qwerty, 123456…)
- Repeated or sequential characters
- Dictionary-like words and common substitutions
- Presence of uppercase, lowercase, digits, symbols
Password Security Guide
What every user should know about passwords
Length is King
A 20-character password with only lowercase letters is harder to crack than a 10-character password with all character types. Each additional character multiplies the search space exponentially.
Use a Password Manager
Tools like Bitwarden (open source), KeePass or 1Password generate and store unique passwords for every site. You only need to remember one strong master password.
Enable Two-Factor Auth
Even a strong password can be compromised in a data breach. 2FA adds a second layer — even if your password leaks, attackers still cannot access your account.
Never Reuse Passwords
When one service is breached, attackers try the same credentials on other sites (credential stuffing). Unique passwords per service limit the blast radius of any breach.