Skip to content
DI
dummyipsum.com

Secure Password Generator

Create a strong random password, a memorable passphrase made of random words or a secure PIN. Set the length and character types, or the number of words, and the password is generated right in your browser.

Generate a PIN

Password type

Bank cards and SIM cards usually use 4 digits, phones at least 6. If the device allows it, choose a longer PIN.

Result

Your PIN

Theoretical combinations

The generator skips easy-to-guess PINs: repeated digits, runs like 1234, well-known picks and dates or birth years. The real number of options is therefore slightly lower.

How to generate a strong password

  1. 1 Choose the password type: random characters or a memorable password made of words.
  2. 2 For random characters, pick a length (we recommend at least 16 characters). For words, pick the number of words (we recommend at least 6).
  3. 3 Click “Generate password” and copy the result securely.
  4. 4 Use a unique password for every account (ideally with a password manager).

Why use a random password generator?

People are bad at making up random passwords. We use patterns, birthdays, names and well-known phrases, and attackers try exactly those first in dictionary attacks. What matters is who picked the password. A phrase you invent, such as "MyCatLovesMilk", is weak because it makes sense and can be guessed. Six words picked at random by a generator from a list of 7,776 words are strong even if the attacker knows the whole list, because the strength comes from the random choice, not from keeping the words secret.

Random characters or a password made of words?

Random characters give the most strength per character, so they suit a password manager that fills them in for you. A password made of words is longer, but it is easier to remember, read and type, for example on a phone or when you read it out to someone. Use it where you have to type the password by hand: your password manager master password, your computer login or the guest Wi-Fi.

Is this password generator safe?

Yes. Passwords are created directly in your browser without sending them to the server. They are displayed only to you and exist only for as long as they are shown on the screen.

Recommended settings

  • Email and social media: 16 random characters or 6 random words.
  • Admin and business accounts: 20+ random characters.
  • Password manager master password or computer login: 6 or more random words you can remember.
  • Wi‑Fi password: 16-24 characters, or 5-6 words if you often read it out to guests.
  • With a password manager: 20+ characters, or the maximum the site allows.

Best practices for password security

  • Use a unique password for every account
  • Length and randomness matter more than mixing character types: at least 16 random characters or 6 random words
  • Don't make up passwords yourself. Even a complex-looking password built on a pattern, such as Summer2026!, can be guessed
  • Add uppercase letters, numbers and symbols mainly when a site requires them
  • Use a password manager - you don't have to remember passwords, so make them longer
  • Enable Two-Factor Authentication (2FA) whenever possible

How many characters should a strong password have?

A password's strength depends on how many possibilities an attacker has to try. The table compares randomly generated passwords of different lengths with passwords made of words.

Length versus complexity

Average time to crack a password by length and character types Bars on a logarithmic scale: 8 lowercase letters about 10 seconds, 8 characters of all types about 3.5 days, 16 lowercase letters about 70,000 years and 16 characters of all types more than a billion years. 1 s 1 day 1 year 1,000 years 1 billion years 8 lowercase letters ≈ 10 seconds 8 characters, all types ≈ 3.5 days 16 lowercase letters ≈ 70,000 years 16 characters, all types more than a billion years logarithmic scale, 10 billion guesses per second

At 10 billion guesses per second, an attacker cracks 8 lowercase letters in about 10 seconds on average.

Uppercase letters, digits and symbols help: 8 characters hold out for about 3.5 days. Still not much.

Doubling the length does far more. 16 lowercase letters hold out for around 70,000 years on average.

16 characters of all types are out of reach. Length helps the most, character types come second.

Password Strength (bits) Average time to crack
8 random characters ≈ 52 about 3.5 days
12 random characters ≈ 79 about 750,000 years
16 random characters ≈ 105 more than a billion years
20 random characters ≈ 131 more than a billion years
4 random words + number ≈ 58 about 7 months
5 random words + number ≈ 71 about 4,500 years
6 random words + number ≈ 84 about 35 million years

Assumptions: every character is picked at random from the 94 printable ASCII characters (lowercase and uppercase letters, digits, symbols). Words are picked at random from a list of 7,776 words, followed by a random two-digit number (00-99). Capitalization and the separator add no strength because they are always the same. Times are illustrative: an offline attack on a stolen database with a fast hash at 10 billion guesses per second. Average time means trying half of all combinations; trying all of them takes twice as long. If a service stores passwords with a slow hash (such as bcrypt or Argon2), the attack is orders of magnitude slower. In an online attack, the service also limits the number of attempts.

Related Tools

More generators for test data, codes and placeholder content.

Random Strings

Random character generator

Open

Lorem Ipsum Generator

Placeholder text generator

Open

UUID Generator

Generate random UUIDs/GUIDs

Open

FAQ

Frequently asked questions

How many characters should a strong password have?

For a randomly generated password we recommend at least 16 characters, in line with CISA. For sensitive accounts (business systems, administration), ideally 20 or more. For a password made of words, choose at least 6 random words. What matters is that a generator picked the password, not you: 16 characters that follow a predictable pattern are far weaker.

How long should a password be with a password manager?

If you use a password manager, you don't have to remember passwords - so set the longest password possible. We recommend at least 20 characters, ideally the maximum the site allows (often 64 or more).

How can I remember a strong password?

Switch the generator to “Passphrase”. It creates a password from random words, such as Sunset-Bridge-Pear-Cloud-Pencil-Lamp-47, which you can picture as an image or a short story. Only memorize the passwords you really have to type by hand, though. Leave the rest to a password manager.

Is a password made of words secure?

Yes, if the words were picked at random. Our generator picks every word with equal probability from a list of 7,776 words, so 6 words and a two-digit number give about 84 bits, or roughly 22 septillion combinations. A phrase you make up yourself (a quote, song lyrics, a sentence about you) is what attackers try first. Capitalization and the separator add no strength because they are always the same.

How many words should a passphrase have?

We recommend at least 6 random words. With our list of 7,776 words, 6 words and a two-digit number give about 84 bits, enough even for a password manager master password. For guest Wi-Fi or less important accounts 5 words are fine; we no longer recommend 4.

How do I create a secure PIN?

Switch the generator to “PIN” and choose as many digits as the device allows. Avoid your birth date, a year, runs like 1234 or repeated digits. Attackers try those first, so the generator skips them. If possible, choose 6 digits rather than 4.

Can a password contain accented letters?

Technically yes, but we don't recommend it. Some websites, apps and keyboards reject letters like é, ü or ñ, or store them differently, and then you can't log in. That is why the generator only uses plain letters a-z. The strength is calculated from the number of unique words in the list, so it is not affected.

Why not use the same password on multiple sites?

If a password is leaked on one service, an attacker can gain access to other accounts as well. Unique passwords significantly reduce the risk of abuse.

Is it safe to generate passwords online?

It is important to use a generator that does not store your data. Our tool creates passwords directly in your browser and does not save them. For extremely sensitive keys, some users still prefer offline tools.