Password generator

Set the length and the kinds of characters, and copy a password made with your browser's secure random number generator. Nothing is sent anywhere or stored.

Kind
Characters to use
Your password Making a password in your browser…
Strength
Very strong
Entropy
125 bits
Time to guess
Longer than the universe has existed
Possible characters
77

Time to guess is the average for an attacker trying 10 billion guesses a second, about what a GPU rig manages against a fast hash. A slow hash such as bcrypt makes it far longer.

Setting up a new server? Use a different password for the root account, the database and the control panel. From €3.02 a month today, among 2,226 servers.

Compare small VPS plans Protect a folder with htpasswd

Works in your browser: nothing you type is sent anywhere.

How the password is made

Each character is picked at random from the characters you allowed, with your browser's cryptographic random number generator (crypto.getRandomValues). Random values that would make some characters more likely are thrown away and drawn again, so every character is equally likely. When you choose several kinds of characters, the password always contains at least one of each.

entropy = length × log2(possible characters)
passphrase = words × log2(words in the list)
time to guess = 2^(entropy − 1) ÷ guesses per second

Entropy measures how many guesses an attacker needs. Every extra bit doubles it, so length matters more than symbols: 20 letters and digits beat 12 characters with every symbol. A passphrase of random words is easier to type and remember, and needs about seven words to be as strong as a 12-character random password.

Example

A 16-character password from upper and lower case letters and digits has 62 possible characters: 16 × log2(62) ≈ 95 bits. At 10 billion guesses a second, finding it takes about 76 billion years on average. Six random words from a list of 1,296 give 62 bits, about 7 years at the same speed.

Make one on the server

On a Linux server you can make a random password without a browser. Any of these commands prints one; pwgen may need installing first (apt install pwgen).

shell 
openssl rand -base64 24
pwgen -s 24 1
head -c 18 /dev/urandom | base64

Questions

Is this password generator safe to use?

Yes. The password is made by your browser's cryptographic random number generator after the page has loaded. It is never sent to our server or stored, and the page works the same with your network switched off.

How long should a server password be?

At least 16 random characters, or 20 and more for anything reachable from the internet, such as a root, database or panel password. For SSH, use a key instead of a password and turn password login off.

Is a passphrase better than a random password?

It is easier to type and remember, and just as strong when it is long enough: seven random words from this list give about 72 bits. Pick the words at random, as here; a phrase you think of yourself is much easier to guess.

Why are some symbols missing?

Quotes, backslashes, spaces, $ and # break shell commands, .env files and connection strings unless they are escaped. The symbols offered here work unquoted almost everywhere. Add length rather than symbols when you need more strength.