If you just need one, use our free password generator. If you trust nothing you have not read, jump to the offline version and inspect it yourself.

Is a password or a passphrase more secure?

A random password is a string of unrelated characters like k7$Rf2!qLmz9. A passphrase is a sequence of random words like correct-anchor-vivid-plum-tunnel. Both can be strong. The difference is where the strength comes from and how you handle it.

Entropy is what matters. A password's entropy is its length times the log base 2 of the character-set size. A passphrase's entropy is the word count times the log base 2 of the wordlist size. Six words from the 7776-word EFF list is 6 × log2(7776) ≈ 77 bits. A 12-character password using all 94 printable characters is 12 × log2(94) ≈ 79 bits. Similar strength, very different to type.

Use a passphrase for anything you have to type or remember, like your device login, disk encryption, or your password manager's master password. Use a long random password for everything your password manager fills in for you, where you never type it and readability does not matter.

How long should a password be?

Length beats complexity. Adding one character to a password multiplies the number of possible combinations far more than swapping a letter for a symbol does. A long simple password beats a short complex one every time.

The current NIST SP 800-63B guidance backs this up. It tells services to allow long passwords, to stop forcing periodic resets, and to drop mandatory composition rules like "must contain a symbol." Length and uniqueness are what protect you.

What is password entropy?

Entropy, measured in bits, is how unpredictable a secret is. Each bit doubles the number of guesses an attacker needs. A secret with 40 bits of entropy takes about a trillion guesses to exhaust. At 80 bits it takes about a trillion trillion. Every extra bit doubles the work.

Worked example: a 4-digit PIN has 10,000 possibilities, which is log2(10000) ≈ 13.3 bits. Trivial to crack. Now take four random words from a 7776-word list. That is 7776 × 7776 × 7776 × 7776 ≈ 3.7 × 10^15 combinations, or about 51 bits. The PIN is shorter to type but astronomically weaker. Entropy, not length in characters, is the real measure.

The generator shows the entropy of whatever it creates, calculated directly from the character set or the wordlist. That number is the honest measure of strength, assuming the attacker knows exactly how the secret was made.

Common password mistakes to avoid

How to create a strong password

The strongest password is one you never invent yourself. Human-chosen passwords cluster around predictable patterns; a machine picking uniformly at random does not. So generate it randomly with the generator, or use a passphrase of six or more words for anything you have to type from memory. Aim for at least 80 bits of entropy, which is roughly a 14-character random password or a 7-word passphrase, and push the entropy readout higher for important accounts.

Make every password unique, so one breach can never cascade into other accounts, and store them in a password manager so length and randomness cost you nothing day to day. Then turn on two-factor authentication, with a hardware key for your email, bank, and password manager.

Do those things and the exact characters no longer matter. Length, randomness, and uniqueness are what stop an attacker, not clever substitutions.

How to store your passwords safely

You cannot remember a unique strong password for every account, and you should not try. Use a password manager. It generates, stores, and fills unique passwords so the only secret you have to remember is one strong master passphrase.

Well-regarded options include Bitwarden (open source, free tier, cloud sync), 1Password (polished, paid), and KeePassXC (fully offline, you control the file). Any of them is a massive upgrade over reuse or a notebook.

Protect the manager itself with a long passphrase and turn on two-factor authentication. For your highest-value accounts, add a hardware security key such as a YubiKey. A physical key cannot be phished or copied remotely.

Are online password generators safe?

Every online password generator you do not control is a trust decision. You are trusting that the server generates the password with secure randomness, that it does not log what it made, that it does not tie the password to your IP address or session, and that its connection is not intercepted. You cannot verify any of that from the outside.

A password that touches someone else's server before it reaches you is already a weaker password, because you can no longer be sure you are the only one who has seen it. Local generation removes the entire question. The secret is created on your device, it stays on your device, and the offline version below lets you cut the network out completely.

Verify it yourself

Do not take our word for any of this. Checking takes under two minutes.

1. Open the generator and open DevTools with F12, or right-click anywhere and choose Inspect.
2. Go to the Network tab and clear any existing entries so you are starting from zero.
3. Generate as many passwords and passphrases as you like. A local generator produces no new requests. Nothing leaves the browser.
4. Download the offline version below, run sha256sum blackout-password-generator.html, compare the hash, then open the file with your network disconnected. It behaves identically, because it is the same code.

If a secret can be generated locally, generate it locally. The same principle is behind Blackout VPN. The less anyone else has to be trusted, the safer you are.