Which kind of password should I use?
- Random: best for accounts saved in a password manager. A 16–20 character password with mixed characters is effectively uncrackable. Easy to read removes look-alikes like l/1 and O/0, and Easy to say uses letters only (make it longer to compensate).
- Memorable: a passphrase of random dictionary words, like Clover-Payday-Ripen7-Spoon. This is the best choice for passwords you have to type or remember yourself, such as your password manager's master password or your computer login. Four words is a solid minimum, and five or six is better for anything critical.
- Sentence: a silly, vivid sentence that's easy to picture and recall, like 42 Sleepy Otters Painted A Kite Under The Purple Moon! Turn on initials to use just the first letters (42SOPAKUTPM!) and keep the full sentence as your memory hint. Sentences trade some strength for memorability, so pick Long for important accounts.
- PIN: digits only, for phones, cards and door codes. The pattern filter skips PINs people guess first, like 1234, 0000, 1212 and years.
How strong is strong enough?
The meter estimates entropy: how many guesses an attacker would need if they knew exactly how the password was generated. Each extra bit doubles the work. The crack-time estimate assumes a fast offline attack at 10 billion guesses per second, the worst case after a website's password database is stolen.
- Under 40 bits is weak, guessable in minutes to hours offline.
- 60+ bits is good for most online accounts, which also limit login attempts.
- 80+ bits is very strong. Use this for master passwords, email and banking.
Strength depends on randomness, not on looking complicated. P@ssw0rd! looks complex but is one of the first guesses attackers try. A random four-word passphrase is far stronger and easier to remember.
Your passwords stay private
Every password is generated in your browser with crypto.getRandomValues, the cryptographically secure random number generator built into your device. Nothing is sent over the network, logged or stored. Memorable passwords use the EFF Large Wordlist (7,772 words, licensed CC BY 3.0 US), designed by the Electronic Frontier Foundation to contain words that are easy to spell and remember.
Checking whether a password has leaked
Billions of real passwords have been exposed in data breaches, and attackers try those first. The leak checker compares a password against Pwned Passwords, Have I Been Pwned's database of passwords from real breaches.
It does this without revealing the password. Your browser turns the password into a SHA-1 code and sends only the first 5 characters of that code. The database replies with every leaked password whose code starts the same way, hundreds of them plus random padding, and your browser checks for a match. Neither we nor Have I Been Pwned can tell which password you checked.
Password tips
- Use a different password for every account, so one breach doesn't unlock the rest.
- Store them in a password manager. Then you only need to remember one strong passphrase.
- Turn on two-factor authentication (2FA) for email, banking and social accounts.
- Never reuse a password that has appeared in a data breach.
Frequently asked questions
Are these passwords safe to use?
Yes. They're created on your device with a cryptographically secure random generator and never leave your browser. Even so, it's good practice to save a new password straight into your password manager and not keep a copy anywhere else.
Is a passphrase really as strong as a random password?
It can be. Each word from the 7,772-word EFF list adds about 12.9 bits, so a 6-word passphrase (~77 bits) is comparable to a 12-character fully random password, and much easier to remember and type.
How long should my password be?
For random passwords, use at least 14–16 characters. For passphrases, use at least 4 words, or 5–6 for important accounts. For PINs, 6 digits is much safer than 4.
Was this calculator helpful?