Password generator
A random password or passphrase, with its strength in bits and time to crack.
- bits of entropy
- —
- to brute-force
- —
No character set is selected
Turn on at least one set of characters in the settings.
Calculated in your browser — nothing is sent to the server
Practice on a machine
Lab “Suspend a user account”
In a Linux terminal
openssl rand -base64 24
# 32 characters: A-Z, a-z, 0-9, + and /
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo
# 20 letters and digits
pwgen -s 20 1
# a fully random password (pwgen package)
sudo passwd ivan
# set a user's password
Keep in mindRoot and encryption keys need 100 bits or more: 16 characters from all four sets.
How many bits you need
| Bits | Good for |
|---|---|
| under 40 | nothing |
| 40–59 | a site that limits login attempts |
| 60–79 | an account with no access to anything important |
| 80–99 | a server, a database, email |
| 100 and more | a master password, an encryption key, root |
FAQ
How long should a password be?
For sites and email, 16 random characters from all sets, about 100 bits. For a master password, 20 characters or a 10-word passphrase.
Which is better: a password or a passphrase?
Equal bits mean equal strength. A passphrase is easier to remember and type, so use one for a master password or a computer login.
Is it safe to generate a password on a website?
Here the password comes from your browser's cryptographic generator, crypto.getRandomValues.
Check it yourself: the Network tab of the developer tools shows no requests.