Password Generator
Strong random passwords and memorable passphrases, generated in your browser. Free, no sign-up.
Entropy 103.6 bits · average time to guess: longer than the age of the universe (assuming 100,000 guesses per second — an offline attack against a slow hash such as bcrypt or Argon2)
How strong is strong enough?
Password strength is usually shown as a coloured bar with no explanation of what it means. The number that actually matters is entropy, measured in bits: it is the base-2 logarithm of how many equally likely passwords the generator could have produced. Each extra bit doubles that number.
A 16-character password drawn from lowercase, uppercase, digits and symbols carries roughly 103 bits. A five-word passphrase from a 7,776-word list carries about 65 bits. Both are far beyond what any attacker can search today — the difference between them matters much less than the difference between either one and a password you invented yourself.
That is the part most guidance gets wrong. Strength does not come from looking random; it comes from being random. A generator that picks uniformly is what makes the entropy figure meaningful.
Why we show the assumptions, not just a number
You will often see a password tool claim something like "113 years to crack". Taken alone, that number is close to meaningless — it depends entirely on how fast the attacker can guess, and that varies by many orders of magnitude depending on how the site you signed up to stored your password.
So we show the assumption alongside the result. On average an attacker needs about 2^(H−1) guesses, where H is the entropy in bits, so the average time is that divided by the guess rate:
- An online login form with rate limiting: perhaps a thousand guesses per second at the very most. Nearly any generated password is out of reach here.
- An offline attack against a slow hash (bcrypt, scrypt, Argon2): on the order of 100,000 guesses per second. This is the figure shown above the generator.
- An offline attack against a fast hash (unsalted SHA-1 and friends): a trillion guesses per second or more. Passwords under about 70 bits start to look uncomfortable here.
None of these models covers the ways passwords are actually lost most often: phishing, malware on your own machine, or a breach at the service that stored it. A strong password protects against guessing. It does not protect against being handed over.
Length beats complexity
Adding one character to a password made of 94 possible symbols multiplies the search space by 94 — about 6.5 bits. Turning on a whole extra character class adds far less than that. If you have to choose between a longer password and a more exotic one, choose longer every time.
This is also why passphrases work. "correct horse battery staple" looks simple, but if each word is drawn at random from a list of 7,776, the phrase is doing real cryptographic work — and you can actually remember it.
Three habits worth dropping
- Substituting @ for a and 3 for e
- Cracking tools have applied these substitutions automatically for decades. P@ssw0rd is not meaningfully harder to guess than password — it is on every wordlist.
- Changing your passwords every 90 days
- NIST withdrew this recommendation in SP 800-63B. Forced rotation pushes people toward predictable patterns (Spring2026!, Summer2026!). Change a password when you have reason to think it was exposed.
- Reusing one strong password everywhere
- A single strong password reused across sites is only as safe as the least careful site holding it. When that one is breached, attackers replay the credentials elsewhere — which is what credential stuffing means.
Questions
Is this password generator free?
Yes, completely free and there is nothing to sign up for. It is a tool page — use it as often as you like.
What length should I choose?
Sixteen characters with all four character types is a good default and is what the generator starts with. Going longer costs you nothing when a password manager is doing the typing. Below twelve characters, start paying attention.
Should I use a random password or a passphrase?
Use a random password wherever something else remembers it for you — which is most places. Use a passphrase for the few secrets you have to type from memory, such as the master password of a password manager or a device login.
What does the entropy figure mean?
It is the base-2 logarithm of the number of equally likely passwords the generator could have produced with your current settings. Each extra bit doubles the number of possibilities. We compute it from the settings you chose, not from a fixed table.
Why do some words in the passphrase contain a hyphen?
The passphrase mode uses the EFF Large Wordlist, and a handful of its 7,776 entries are hyphenated words such as t-shirt. They are kept because removing them would change the list size and therefore the entropy. If you pick the hyphen as your separator, word boundaries become harder to read — the tool will point that out.
Can I use these passwords for anything?
Yes. Nothing here is tied to KeyMe Pass — the generated passwords are ordinary strings you can use wherever you like.
How do I keep track of passwords like these?
You need something that remembers them for you, because the whole point is that they are not memorable. Any reputable password manager will do; ours is linked below.
Somewhere to keep them
A generated password is only useful if it is still there when you need it. KeyMe Pass stores passwords, passkeys and 2FA codes in one encrypted vault, fills them in on your phone and in your browser, and does not limit how much you can save.
Get KeyMe Pass — freePassphrase wordlist: EFF Large Wordlist for Passphrases (7,776 words), © Electronic Frontier Foundation, licensed under CC BY 3.0 US. Modified: the dice-roll column was removed. eff.org/dice (7776)