BcryptGenerator.org

Free Password Generator

Create strong, random passwords or easy-to-remember passphrases. Everything is generated in your browser with a cryptographically secure random number generator, so nothing is sent to a server, saved or logged. No sign-up.

Processed in your browser — no data sent to servers

Edit this if a site only accepts certain special characters.

How long should a password be?

Longer is stronger, and length matters more than anything else. The U.S. National Institute of Standards and Technology's SP 800-63B guidelines require:

  • At least 15 characters for a password that is the only thing protecting an account
  • At least 8 characters when the password is combined with another factor, such as an authenticator app
  • No forced composition rules (like "must contain a symbol") and no forced periodic changes

That's why this generator defaults to 16 characters. If you store passwords in a password manager, you never have to type or remember them, so 20 or more costs you nothing. The presets above cover the most common requirements: 8, 12, 15, 16, 20 and 32 characters.

Random password or passphrase?

Strength is measured in bits of entropy: each extra bit doubles the number of guesses an attacker needs. These are the exact values for this generator's settings, using all four character types (87 possible characters) or the 7,776-word EFF list:

SettingEntropy
8 random characters51.5 bits
12 random characters77.3 bits
16 random characters (default)103.1 bits
20 random characters128.9 bits
4-word passphrase51.7 bits
5-word passphrase64.6 bits
6-word passphrase (default)77.5 bits

Use a random password for anything stored in a password manager. Use a passphrasefor the few passwords you have to type or remember yourself, such as your password manager's master password or your computer login. A six-word passphrase is about as strong as a 12-character random password, and much easier to type correctly.

How this generator works

Every character or word is picked with crypto.getRandomValues(), the browser's cryptographically secure random number generator, the same source used for encryption keys. Two details make the results trustworthy:

  • No bias. Random numbers are mapped onto the character set with rejection sampling, so every character is equally likely. A naive random % length would make some characters slightly more common.
  • Every selected type is included, fairly. When you tick uppercase, lowercase, numbers and symbols, each password contains at least one of each. Rather than forcing them into fixed positions, which would make passwords more predictable, the generator simply discards any candidate that misses a type and draws again.

Passphrase words come from the EFF's large word list, designed for generating memorable passphrases. Its words are at most 9 letters, so even six words with separators stay under 60 characters.

For developers: hash it with bcrypt

Need a password for a seeded admin account or a test fixture? Generate one, then click Hash with bcrypt to get a cost-12 hash you can put straight into your database. Remember that bcrypt only uses the first 72 bytes of a password, so the generator warns you when a password goes over that. See bcrypt's maximum password length for why it matters. You can verify any hash with the bcrypt checker, or create hashes for your own passwords with the bcrypt generator.

Generate a password from the command line

Each of these uses the operating system's secure random source:

OpenSSL (Linux, macOS, Git Bash): 24 characters

openssl rand -base64 18

Python: 22 URL-safe characters

python -c "import secrets; print(secrets.token_urlsafe(16))"

Node.js: 24 URL-safe characters

node -e "console.log(require('crypto').randomBytes(18).toString('base64url'))"

Keeping passwords safe after you generate them

  • Use a different password for every account, so one breach can't unlock the others
  • Store them in a password manager rather than a note or spreadsheet
  • Turn on multi-factor authentication wherever it's offered
  • Check an existing password with the password strength checker

Password Generator FAQ

Is it safe to use an online password generator?+

It depends on where the password is created. This one generates passwords entirely in your browser with the Web Crypto API, and nothing is sent to a server or stored. You can even disconnect from the internet after the page loads and it keeps working. Avoid generators that create passwords on their server, because you can't see what happens to them there.

How long should a password be: 12, 15 or 16 characters?+

NIST's current guidelines require at least 15 characters when a password is the only thing protecting an account, and at least 8 when it is combined with another factor such as an authenticator app. For a random password from a password manager, 16 characters or more is a good default; it costs you nothing because you never type it.

Do I need special characters?+

Not for strength: length adds more security than symbols do, and NIST advises sites not to force composition rules. Many sites still require a symbol, though, so the generator includes them by default. If a site rejects certain symbols, edit the symbol list or turn symbols off and add a few characters of length instead.

Are passphrases as secure as random passwords?+

They can be, if the words are chosen randomly from a large list. Each word from the 7,776-word EFF list adds about 12.9 bits, so six words give roughly 77.5 bits, about the same as a 12-character random password, but far easier to remember and type. A phrase you choose yourself, like a song lyric, is much weaker.

Do you store or see the passwords I generate?+

No. Generation happens in your browser, nothing is sent over the network, and nothing is saved. Close the tab and the passwords are gone, so copy them into your password manager first.

Can I generate several passwords at once?+

Yes. Choose 5, 10 or 20 in the "How many" menu and use "Copy" to copy them all, one per line. That's handy for test accounts or seeding a development database.