Strong password generator
Make a random password, a passphrase you can remember, or a PIN. Everything is generated in your browser with a cryptographically secure random generator, and nothing is sent or stored.
Words come from the EFF large wordlist (7,776 words, about 12.9 bits each).
How to make a strong password
- Pick a kind. A random password is best for a password manager. A passphrase is easier to type and remember, good for your computer login or the manager's master password. A PIN is for phones and cards.
- Set the length. 16 or more characters, or 5 or more words, is strong for nearly everything. The meter shows the entropy and how long a brute-force attack would take.
- Copy it straight into your password manager. Press New for another one.
What makes a password strong?
Strength comes from randomness and length, measured in bits of entropy. Each extra bit doubles the number of guesses an attacker needs. A random 12-character password from all 94 printable characters has about 79 bits; 20 characters has about 131 bits. Human-made passwords like Summer2026! are much weaker than they look, because attackers try words, names, dates and common substitutions first. Never reuse a password across sites: when one site leaks, attackers try the same email and password everywhere else.
Passphrases (diceware)
A passphrase strings together random words, like cobalt-dosage-unwind-gravity-pebble-tulip. With the EFF wordlist each word adds about 12.9 bits, so six words give about 77 bits: as strong as a random 12-character password, but far easier to type and remember. The words must be chosen at random, never by you, and this tool picks them with your browser's secure random generator.
Is this generator safe?
Yes. Passwords are made on your device with crypto.getRandomValues, the cryptographically secure generator browsers use for encryption keys, with rejection sampling so every character is equally likely. The page never sends, logs or stores what it generates, and works offline once loaded.
Questions
How long should my password be?
For a random password, 16 characters or more. For a passphrase, at least 5 words, or 6 or more for a master password. Longer is always stronger.
Are passphrases as secure as random passwords?
Yes, when the words are chosen at random from a large list. Six words from the 7,776-word EFF list give about 77 bits of entropy, similar to a random 12-character password with symbols.
Should I include symbols?
They help a little per character, but length helps more. If a site rejects some symbols, turn them off or exclude the ones it doesn't accept, and add a few characters of length instead.
What does bits of entropy mean?
It measures how many guesses an attacker would need: n bits means 2 to the power n possibilities. 60 bits is decent, 80 bits is strong, and 128 bits is beyond any brute-force attack.
How is the crack time calculated?
It assumes an offline attacker trying 100 billion guesses per second (a GPU rig against a fast hash like MD5 or SHA-1) and finding the password after searching half the possibilities on average. Slow hashes like bcrypt make real attacks millions of times slower.
Is the password sent anywhere?
No. It is generated in your browser and never sent, logged or saved by navaja.dev.
Can I generate many passwords at once?
Yes. Set How many to up to 500, then copy them all or download a text file. Each one is independently random.