Password Generator

The Password Generator uses your browser’s cryptographic random numbers to create passwords that are hard to guess. The password is made on this device only and is never saved or sent to a server.

Passwords like these aren’t meant to be memorized. Keep the ones you memorize to two or three, such as the one that opens your password manager and your email password. Save the rest in your browser or a password manager so they fill in for you. Add a keyword only where you have to type the password yourself.

A password’s strength comes from how many different passwords could have been made. More available characters and a longer length make that number grow very quickly.

This tool makes sure every type you choose appears at least once and no character appears 3 times in a row, so the strength shows the exact count with those rules applied. If you add a keyword, it assumes others could know the word and counts only the random part.

Every service has its own password rules. Here is what their official help pages say.

Google also rejects leading or trailing spaces and passwords you’ve used before. Microsoft 365 rejects Unicode characters, accepts up to 256 characters, and recommends 14 or more. NIST says services should accept at least 64 characters. Amazon Pay advises against using your name or username.

The 4 types are uppercase, lowercase, numbers, and symbols. Services whose rules we couldn’t find in official help, such as Apple, aren’t in the table.

This tool’s defaults are a common standard that meets every rule above.

• 12 characters long. That’s above every minimum in the table and matches Google’s advice.
• At least one uppercase letter, lowercase letter, number, and symbol, so sites that require 3 types accept it.
• Only the 32 symbols on an English keyboard. Microsoft 365 allows all of them.
• No character appears more than twice in a row.
• If an account signs in with a password alone, without two-step verification, make it 15 or more to meet NIST.

Some password policies also block the same character 3 or more times in a row. None of the services above mention it in their official help, but the Linux password checker libpwquality has this setting (maxrepeat). Avoiding it removes very few possibilities, so this tool always avoids it and counts it in the strength.

Under the password, Common site rules shows which rules it meets right now. It checks the whole password, keyword included.

Korean keyboards share keys with English ones. On the standard Korean Dubeolsik layout (KS X 5002), ㅋ is on z, ㅓ on j, ㅍ on v, and ㅣ on l, so typing “커피” (coffee) presses zjvl. Double final consonants like ㄳ and compound vowels like ㅘ take two keys, as they look.

Depending on the browser or operating system, password fields may block Korean input and take the English keys as typed. So this tool turns Korean words into English keys. You get the same password wherever you type it, and it works on sites that accept only English keyboard characters.

Upper and lower case of these keys mean different letters (r is ㄱ, R is ㄲ), so Korean words keep their case.

Because every site has different rules, many people add the site’s name or a number to one base word. But NIST treats service names, usernames, and their variations as weak passwords that sites should block, and the UK’s National Cyber Security Centre (NCSC) warns that reusing a password lets one password unlock all your accounts.

Putting their advice together, this order is safest:

• Use a password manager. The one built into your browser works too. Make a random password that fits each site’s rules and save it there, so you never have to remember it.
• Remember only the passwords you must, such as your password manager and email. Make those long and memorable.
• Keep your email password different from all others, since email can be used to reset other passwords.
• Turn on 2-step verification.

NIST notes that password managers, especially ones with a password generator, make people more likely to choose stronger passwords.

NIST says services shouldn’t force periodic password changes and should require a change only when there’s evidence of a breach. Some sites still ask for a new password every few months, so you need a way that stays easy to remember but hard to predict.

• Pick one keyword you can remember and decide where the random characters go.
• When it’s time to change, keep the word and settings and click Generate new to replace only the random part.
• Save the new password in your password manager right away.

Changing only the last digit gives just 10 possibilities, while a brand-new random part gives as many as the strength shows.

The U.S. National Institute of Standards and Technology’s digital identity guidelines (SP 800-63B-4) ask services that accept passwords to follow these rules:

• Require at least 15 characters when the password is the only way to sign in, or at least 8 when used with another factor.
• Allow a maximum length of at least 64 characters.
• Don’t force mixtures of uppercase letters, numbers, and symbols.
• Don’t force periodic changes. Require a change only when there is evidence of a breach.
• Allow password managers, autofill, and pasting.

Adding length grows the number of possible passwords faster than adding character types.