Generate it here
A strong password is long and random, and a passphrase of several random words is easier to remember. This generator runs entirely in your browser using the Web Crypto API, so nothing is sent to anyone and nothing is stored.
Runs in your browser. Nothing is sent or stored.
[Generator widget: length slider, character sets, and passphrase mode with word count and separator.]
Pick Password for something you will paste from a password manager, and Passphrase for the few secrets you must type from memory, such as a device login or your password manager's master password.
Why it is safe to use an online generator
An online generator is only a risk if the page sends what it makes to a server. This one doesn't. It calls crypto.getRandomValues(), which MDN describes as returning cryptographically strong random values suitable for cryptographic purposes. It never uses Math.random(), which MDN lists as a non-cryptographic source of random numbers.
You can check this yourself: load the page, turn off your network connection, and the generator still works. Close the tab and the result is gone.
How long should a password be?
Longer is better, and length matters more than symbol rules. NIST's current guidance, SP 800-63B (part of the 800-63-4 series, page dated 26 Aug 2025), says:
| Situation | Guidance (NIST SP 800-63B) |
|---|---|
| Password is the only factor | At least 15 characters |
| Password used only alongside another factor (MFA) | At least 8 characters |
| Maximum length services should accept | At least 64 characters (a "SHOULD") |
| Composition rules (must include a symbol, etc.) | Services "SHALL NOT impose" them |
The OWASP Authentication Cheat Sheet repeats the same thresholds and also recommends allowing at least 64 characters so passphrases fit.
These are minimums for services to enforce. For a password you never type, there is no reason to stop at 15. Use 16 to 20 random characters from a password manager, and go longer wherever the site allows it.
What random length buys you
Each character from a set of N symbols adds log2(N) bits. For a truly random password:
| Character set | Bits per character | 16 characters |
|---|---|---|
| Letters and digits (62) | about 5.95 | about 95 bits |
| Letters, digits and symbols (94 printable ASCII) | about 6.55 | about 105 bits |
This arithmetic only holds when the characters are chosen at random. A password you invent, like P@ssw0rd2026!, has far less entropy than its length suggests. OWASP also notes that entropy estimates are illustrative rather than exact measures of strength.
Password vs passphrase
A passphrase is a password made of several randomly chosen words, such as four to seven words joined by a separator. The key word is randomly: words you pick yourself are guessable, and a famous quote or song lyric is not a passphrase.
Entropy per word depends on the size of the word list. The EFF's long list has 7,776 words, which gives about 12.9 bits per word. The EFF suggests six words for most uses, about 77 bits.
| Words (7,776-word list) | Approx. entropy |
|---|---|
| 4 | about 52 bits |
| 5 | about 65 bits |
| 6 | about 78 bits |
| 7 | about 90 bits |
So which should you use?
- Passphrase: secrets you type or remember. Six words is easy to say aloud and about as strong as a 12-character fully random password.
- Random password: everything else, where a manager fills it in for you and length costs nothing.
How many words should a passphrase have?
Six words from a 7,776-word list is a sound default, and the EFF recommends it. Go to seven or more for something you want to last, such as the master password protecting a vault. Four words is fine only for low-value accounts, ideally with a second factor.
Where to keep what you generate
A generator makes a good password. It can't remember it for you, and reusing one password across sites undoes the work. You need somewhere to store each one.
Secure It Password Manager has a generator built in, with a length slider and character sets, next to the vault where the result is saved. Secure It is a zero-knowledge password manager that stores your encrypted vault in your own Google Drive: no company servers, not even ours. The vault is encrypted on your device with Argon2id and AES-256-GCM before it goes anywhere. See how we handle security for details, and downloads for the platforms available today.
The passphrase mode is a feature of this web tool. The in-app generator offers a length slider and character sets.
One honest limit: Secure It has not had an independent security audit yet.
Habits that matter more than the generator
- Use a different password for every account.
- Turn on two-step verification wherever it is offered.
- Make your master password a long random passphrase, and keep the recovery phrase offline.
- Don't type generated passwords into chat or email; paste them straight into the site.
More answers are in our FAQ.