Password Tools
Four ways to make a password and one way to check one. The right choice depends almost entirely on who has to type it.
All 5 tools
- Password GeneratorStrong random passwords, up to 50 at once.
- Passphrase GeneratorWord-based passphrases you can actually type.
- Password Strength CheckerTest a password without sending it anywhere.
- Memorable Password GeneratorShort real words that fit a signup form.
- Pronounceable Password GeneratorPasswords you can say out loud.
Which one do you want?
Every generator here produces a password nobody can guess. They differ in what happens next — in whether a machine fills the field or a person types it, and in what that person has to do with it.
| If the password is | Use | Default |
|---|---|---|
| Filled in by a password manager | Password Generator | 16 chars · 102 bits |
| Typed from memory, with no length limit | Passphrase | 6 words · 78 bits |
| Typed into a signup form that caps the length | Memorable | 4 words · 41 bits |
| Read out loud to another person | Pronounceable | 5 syllables · 45 bits |
| One you already have | Strength Checker | nothing is sent |
The rule behind the table
Most of your passwords should not be memorable at all. If software fills the field, a fully random string is stronger and costs you nothing to remember, which is why the password generator is the default answer and the site's homepage.
The other three exist for the handful you actually type: a device login, the manager itself, an account you need on somebody else's laptop. Each buys memorability at a different price, and each page states that price in bits rather than implying there is no cost.
Words or syllables?
The passphrase and memorable generators both draw real words, from EFF's long and short lists respectively. The pronounceable generator uses no dictionary at all — its 285 syllables were never words — which packs about 3.1 bits into each letter, against 1.8 and 2.3 for the two word lists.
In practice: words when you have to recall it a week later, syllables when you have to say it down a phone line.
Checking a password you did not generate
The strength checker estimates how many guesses an attacker would need rather than counting character variety, which is why it rates Password1! at 11.9 bits where the usual formula says 65.7.
Whatever you type into it stays in the page. If you have any doubt about that — and you should have some doubt about any site that asks for a password — test it with a stand-in of the same length and shape, or disconnect from the internet first and watch it keep working.
Frequently asked questions
Which password tool should I use?
For most accounts, the password generator: a password manager fills the field, so a fully random 16-character password costs you nothing to remember. Use a passphrase for the few you type from memory, a memorable password when a signup form caps the length, a pronounceable one when it has to be read aloud, and the strength checker for a password you already have.
Should every account have its own password?
Yes. When one site is breached, its passwords get tried against other sites, so a reused password turns one breach into several. A password manager is what makes a different password for every account practical, and it is also why most of those passwords never need to be memorable.
How often should I change my passwords?
Only when there is a reason to. NIST SP 800-63B-4 §3.1.1.2 says services SHALL NOT require people to change passwords periodically, and SHALL force a change when there is evidence a password has been compromised. Change one straight away if a site reports a breach, or if you typed it somewhere you should not have.
Is it safe to generate a password on a website?
It depends on where the password is made. Every tool here builds it in your browser with crypto.getRandomValues() and never sends it anywhere. You can check that yourself: open the Network panel in your browser’s developer tools and generate a few, or disconnect from the internet and watch the tools keep working.
Can this site store my passwords for me?
No, and that is deliberate. Nothing you generate is saved — not on a server and not in your browser’s storage — so there is nothing here to breach and nothing to recover. Keep the passwords you create in a password manager.