Nookbyte Password generator
Make strong random passwords or easy-to-type passphrases. They are made on your device with your browser's secure random generator, and never sent or stored.
More passwords
How it works
- Choose random characters or a passphrase, and how long it should be.
- Your browser picks each character or word with crypto.getRandomValues, its secure random generator, using rejection sampling so every choice is equally likely.
- The bits show how many different passwords these settings can make. The time is how long finding yours would take on average at 100 billion guesses a second, a fast attack on a stolen password database.
- Copy the password into your password manager or the sign-up form. Nothing is kept on this page after you leave it.
Strength labels
| Label | Bits | Average time at 100 billion guesses a second |
|---|---|---|
| Weak | under 45 | under 3 minutes |
| Fair | 45 to 64 | up to about 6 years |
| Strong | 65 to 79 | up to about 190,000 years |
| Very strong | 80 or more | about 190,000 years or more |
Word list credit
Passphrases use the EFF Large Wordlist for Passphrases by the Electronic Frontier Foundation, used under EFF's Creative Commons Attribution (CC BY) license. The file is served unchanged from this site.
Questions
Are the passwords sent or saved anywhere?
No. Your browser makes them on your device with its built-in secure random number generator. They are not sent to Nookbyte or anyone else, and this page does not save them. The only thing the page downloads is the word list, the first time you make a passphrase.
How random are they?
Every character and every word is picked with crypto.getRandomValues, the browser's cryptographically secure random generator. Picks use rejection sampling, so no character or word comes up more often than another.
What do the bits mean?
Bits of entropy count how many different passwords the current settings can make: each extra bit doubles the number. The estimate assumes the attacker knows exactly how the password was made, so it does not rely on keeping the method secret. 80 bits is about 1.2 million billion billion possibilities.
Random characters or a passphrase?
A passphrase of 6 random words (77.5 bits) is about as strong as 12 random characters from all four types (78.7 bits), and much easier to remember and type. Use random characters where a password manager fills them in for you, and a passphrase for the few passwords you must type, such as the one that unlocks your password manager.
How long should a password be?
For accounts in a password manager, 16 or more random characters is plenty. For a password you type, use at least 6 words. Every password should be different, so one leak cannot open your other accounts.
Why does using every type lower the bits a little?
Requiring every type rules out the passwords that happen to miss one, so there are slightly fewer possible passwords. The generator redraws until a password qualifies, which keeps every allowed password equally likely, and the bits shown are worked out exactly for that.
Which word list do passphrases use?
The EFF Large Wordlist for Passphrases, 7,776 common English words picked by the Electronic Frontier Foundation to be easy to remember, type and spell. Each word adds about 12.9 bits.