Password generator and checker

What the tool does

Everything runs only in your browser. We never send your password or the generated values anywhere.

• The password generator picks characters with the browser's cryptographic random generator (Web Crypto). Each selected character group appears at least once, because many services require it. We also show the password's randomness in bits.
• The passphrase generator combines random words from a Czech or English list. A passphrase is easier to remember and to type on a phone, and with enough words it is as strong as random characters.
• The strength check estimates how many guesses an attacker would need. It uses the zxcvbn library, which recognizes tens of thousands of common passwords, Czech and English words, names, dates, repetitions and keyboard patterns.

How to read the result

For generated passwords we know exactly how many possibilities the generator chose from, so we show the randomness in bits. Each extra bit doubles the number of guesses. Around 60 bits is enough for ordinary accounts; for a password manager's master password or disk encryption, aim for about 80, which eight words from our list provide.

For a password you type, the result is only an estimate: the tool looks for known patterns and counts how many guesses would find them. The time to guess assumes an attacker obtained the database of a service that stores passwords with a slow hash (10,000 guesses per second). If the service protects passwords less well, it is many times faster. The rating from "very weak" to "strong" follows this time: about two minutes, a day, four months and thirty years.

Password2024!                 → weak: a word, a year and an exclamation mark
P@ssw0rd123                   → very weak: a known password with substitutions
kT9#vQ2$mL8!pZ4@              → strong: 16 random characters (~103 bits)
garden-window-music-paper     → 4 random words (~40 bits), add more

How to keep strong passwords without the hassle

1. 1

   Use a password manager

   A password manager (such as Bitwarden, 1Password or the one built into your browser) remembers a random password for every service. You only remember one master password.

2. 2

   Make the master password a passphrase

   Generate a passphrase of 8 random words for the master password. Do not pick the words yourself; people choose predictably.

3. 3

   A different password for every service

   After a breach, attackers try the same password elsewhere. A unique password limits the damage to one service.

4. 4

   Turn on multi-factor authentication

   For email, banking and work accounts, use a passkey, an authenticator app or a security key. SMS is better than nothing, but it can be redirected.

5. 5

   Change a password when it leaks

   Routine changes without a reason lead to passwords like "Spring2026!". Change a password when a service reports a breach or you suspect misuse.

What the tool cannot tell you

• It does not know whether your password has already leaked. Have I Been Pwned can check that: your browser sends it only the first 5 characters of the password's SHA-1 hash, never the password. Most password managers offer the same breach check.
• The estimate cannot recognize personal details an attacker may know about you, such as a child's name or a wedding date.
• The estimate does not know how a password was created, so it may rate a passphrase from our generator higher than its bits justify; for generated values, the randomness figure is what counts.
• Even a strong password is weak if you reuse it or type it into a phishing page.
• The strength estimate is a guide. The real time to crack depends on how the service stores passwords and whether it limits login attempts.

Common questions