Start with real English words. Add your own requirements.
Make a password that feels a little less random.
A relaxed rating for word-based passwords. Other sites may rate this lower; it is not a security guarantee.
A friendly tipLonger passwords give your words more room—and usually offer better protection. Use a different password for every account.
A few familiar words can make all the difference.
We combine familiar English words to fit your length. A random letter fills a one-character gap. Short, tightly constrained passwords may contain no complete words. Our 5,000-word dictionary includes a subset of EFF’s passphrase word list (source and license).
Choose exact counts or check “at least” for flexibility. Capital letters go at the start of words first, then at other letter positions when needed.
Your browser selects words using cryptographic randomness. Generated passwords are not sent to our server or saved by this tool.
The estimate counts the available choices for each selected word, random letter, digit and symbol. It treats words as dictionary choices, rather than assuming every letter is independently random. Capitalization and placement are not counted as extra security. The labels use a deliberately relaxed scale for memorable word-based passwords: Very weak below 10 estimated bits, Weak from 10, Fair from 18, Strong from 28, and Very strong from 40. These are this tool’s own labels, not standard security thresholds. Other websites may rate the same password lower. They do not predict cracking time or guarantee protection.
Fair starts at 12 characters with one uppercase letter, digit and symbol. Strong starts at 18 characters with one uppercase letter, two digits and one symbol. Very strong starts at 24 characters with two of each. Selecting a preset resets the fields and unchecks every “at least” box. Values cannot go below that preset’s minimums. These are input presets, not guaranteed strength ratings: the generated password’s actual estimate is shown separately.
Often it is not. Familiar words are also familiar to attackers. The default length of eight is provided for compatibility; choose a longer password and a minimum strength for better protection. Use a password manager and enable multifactor authentication where available.
Yes. Set the length and counts to match that website. Additional symbols come from ! @ # $ % & * + - = ?. Word separators are separate additions and also count toward total length. If the site has a different allowed-symbol list, check compatibility before using the password.