Secure Password Generator

Generate a secure password you can actually type from memory

This password generator builds passphrases — several real words joined by a separator, with an optional number and special character — rather than a wall of random symbols. A new passphrase appears the moment the page loads and regenerates automatically every time you change an option, so there is no form to submit. Click the passphrase itself, or the Copy button, to put it on your clipboard.

The words are drawn at random from a wordlist stored on our server; your browser asks for a word count and a list of dictionary categories, and nothing else. The assembled passphrase is built entirely in your browser. It is never sent back, never written to a database, and never logged. Reload the page and the passphrase you were looking at is gone for good, so copy it into your password manager before you navigate away.

How to generate a password with this tool

• Take the default. Out of the box the tool produces four words from the base dictionary, joined with hyphens, first word capitalised, a number from 0–999 on the end, and an exclamation mark. That configuration scores roughly 76 bits of entropy and is rated Strong. For most accounts you can stop there and click Copy.
• Need more strength? Drag the Number of Words slider from 4 to 5. That one change pushes the same configuration past 91 bits and moves the rating to Very Strong. Each additional word from the base dictionary adds a little over 15 bits.
• Hit a site that rejects the output? Change the separator or drop the special character rather than shortening the passphrase. Length is where nearly all the strength lives; the punctuation is a rounding error by comparison.
• Generate a different one. Press Generate New. The options stay put and only the words and the random number change, which is useful when a passphrase happens to land on a word combination you would rather not type into a shared screen.

Because generation re–fires on every option change, you can watch the entropy figure and the crack–time estimates move as you adjust the settings. That live feedback is the point of the right–hand panel: it turns “is this good enough?” into a number you can compare against a policy.

Every option, and what it actually changes

Word dictionaries. The base dictionary holds 35,579 words and is selected by default. Alongside it are three professional lists — Computer (655 words), Legal (649) and Medical (610) — and ten themed lists: Sports, Superhero, Star Trek, Star Wars, Fantasy, Food, Animals, Mythology, Dinosaurs and Pirates. Each checkbox shows its live word count, and the running total of the selected lists appears underneath. You can tick any combination; the pools are merged before words are drawn. If you untick everything, the tool falls back to the base dictionary rather than failing.

A word of warning about the themed lists: they are small. Selecting only a themed list shrinks the pool from tens of thousands of words to a few hundred, and the entropy figure drops sharply to match. They are best used as an addition to the base dictionary — to make a passphrase more memorable for a particular team — not as a replacement for it.

Number of words (3–10). The single most important control. Entropy from the words alone is log2(pool size) × word count, so with the 35,579–word base list each word contributes about 15.12 bits.

Word separator. Hyphen, space, period, underscore, none, or a custom string of up to three characters. Hyphen is the default and the safest choice for compatibility. Space works in most modern password fields but still trips up older systems and some command–line tooling. “None” runs the words together, which makes the result shorter and harder to read back over the phone.

Capitalisation. Five modes: lowercase, UPPERCASE, Title Case, RaNdOm, and First word (the default, which capitalises only the first word). The entropy each contributes is honest about how little it buys: First word adds exactly 1 bit, Title Case adds 1 bit per word, and RaNdOm adds 1 bit per letter — the only capitalisation mode that meaningfully moves the number, at the cost of being effectively untypeable from memory. lowercase and UPPERCASE add nothing at all, because there is only one way to apply them.

Add number. Place a random number at the end (default), at the start, between the words, or at a random position, or leave it off. The range selector offers 0–99, 0–999 (default) or 0–9999, worth about 6.6, 10 and 13.3 bits respectively. Note that the number is inserted using the same separator as the words, so with the hyphen default it appears as its own hyphen–delimited chunk.

Add special character. A single character from ! @ # $ % ^ & *, placed at the end (default), at the start, or at a random position inside the string. You choose which character, so an attacker who has watched you generate passwords learns which one you always pick — the entropy model generously credits 5 bits here on the assumption the attacker has to guess among 32 common symbols. Do not lean on it.

Worked examples: what each setting is worth

All figures below use the base dictionary at 35,579 words and the tool's own entropy formula. The strength bands are fixed: under 25 bits is Weak, 25 to 40 is Fair, 40 to 60 is Good, 60 to 80 is Strong, and 80 and above is Very Strong.

Read the table twice and the lesson lands: four words plus a number plus a symbol (76.4 bits) is weaker than six bare words (90.7 bits). The decorations that password policies obsess over — the digit, the punctuation, the capital letter — are collectively worth about 16 bits, roughly one extra word. Adding a word is cheaper for you to remember and buys more.

Reading the strength panel and the crack–time estimates

The right–hand column shows entropy in bits, a strength label, and four attack estimates. Every time figure is an average case — half the keyspace — not a worst case, so a determined attacker could get lucky in half that time.

• Online attack models 1,000 guesses per second against a live login endpoint. This is the scenario a rate limiter or an account lockout is supposed to prevent, and the number here should be enormous for any credential you care about.
• Offline attack and Cloud GPU brute force both model 158 billion hashes per second, the tool's stated figure for an NVIDIA H100. Because both use the same rate, these two times are always identical — that is expected, not a bug. The cloud panel adds a dollar cost on top, computed at $2 per GPU hour.
• Dictionary attack is the one that matters most, and the only estimate that models an attacker who knows you used this tool. Instead of guessing characters, it guesses word combinations: pool size raised to the word count, multiplied out by the separator choice, capitalisation mode, number range and symbol placement. If you are choosing between two configurations, compare their dictionary numbers, not their brute–force numbers.

The gap between the brute–force and dictionary figures is the price of using a known wordlist. It is a price worth paying, because the passphrase is one you will actually remember instead of writing on a sticky note — but the tool shows you the number rather than hiding it, and you should look at it.

Common mistakes and how to spot them

• The entropy figure collapsed after you picked a theme. You unticked the base dictionary. Selecting only Pirates or only Star Wars leaves a pool of a couple of hundred words. Re–tick Base Dictionary and the number returns; the total selected word count under the checkboxes is the fastest way to confirm.
• You are hunting for a character–length control. There isn't one. This tool is word–count driven, not character–count driven, so if a site demands exactly a certain number of characters you will need to trim the output by hand or use a character–based generator instead. Output length varies run to run, because the words themselves vary in length.
• You reused the passphrase across two accounts. Entropy protects you against guessing, not against a breach at one provider being replayed at another. Generate a fresh one per account and store them in a password manager.
• You typed the passphrase from the screen instead of copying it. Words from the professional dictionaries in particular are easy to mistype. Click the passphrase to copy; the “Copied!” confirmation appears for two seconds.
• You changed an option and lost the passphrase you liked. Any option change triggers a fresh generation. Copy first, then experiment.
• “Error generating passphrase” appears. The wordlist request failed — usually a dropped connection or a blocked request. Press Generate New to retry.

When to use a passphrase, and when to use something else

Passphrases are the right answer wherever a human has to type the secret: a laptop login, a disk encryption passphrase, an SSH key passphrase, a password manager's own master password, a Wi–Fi pre–shared key that guests will read off a card. In all of those cases memorability and transcription accuracy are real constraints, and a hyphenated word sequence beats a random symbol string on both while reaching comparable entropy through length.

They are the wrong answer where nothing human ever reads the value. API keys, service account credentials, database passwords and anything else that lives in a secrets manager should be long random character strings generated by that tooling — there is no memorability benefit to trade for, so take the higher entropy per character. Passphrases are also a poor fit for systems with a hard low character cap, or fields that reject spaces and punctuation without telling you which; there, a shorter random string is the pragmatic choice.

Whichever style you land on, the rules that actually reduce risk are unchanged: one unique credential per account, stored in a password manager, with multi–factor authentication turned on wherever the service supports it. A 91–bit passphrase protects nothing if the same one guards a dozen accounts and one of them is breached.