Password Generator: Strong Passwords and Passphrases

If you run an online store, your passwords protect more than an inbox. Your Shopify or WooCommerce admin, PayPal, the domain registrar, your ad accounts and the email that can reset all of them are each worth money to an attacker. The single most useful habit is a different, random password for every one of them, kept in a password manager. This generator makes those passwords for you.

It runs entirely in your browser. Every character comes from crypto.getRandomValues, the cryptographic random generator built into modern browsers, and nothing you generate is sent, logged or stored. The tool remembers your settings on this device, never the passwords.

How to generate a strong password

1. Pick a type at the top: Password for random characters, Passphrase for random words, or PIN for digits only.
2. For a password, drag the length slider (8 to 64 characters, 20 by default) and choose the character types: uppercase, lowercase, numbers and symbols.
3. Tick Avoid look-alikes if you will ever read the password aloud or type it from paper. It removes 0, O, o, 1, l, I and the pipe character.
4. Edit the Symbols to use box if a site rejects some symbols. The default set is ! @ # $ % ^ & * - _ = + ?
5. Read the strength bar, the entropy in bits and the crack-time line. Click New for another one.
6. Click Copy and paste the password straight into your password manager and the site you are signing up for.

Need a batch, for example for staff accounts or test logins? Choose 5, 10, 25 or 50 under Need more than one?, click Generate list, then copy them all or download a .txt file.

How the strength and crack time are calculated

Strength is measured as entropy: how many guesses an attacker would need if they knew exactly how the password was made. For a random password, entropy in bits equals the length multiplied by log2 of the number of possible characters. With all four types on and the default symbols, there are 75 possible characters, so each one adds about 6.2 bits.

The crack-time line assumes an attacker who has stolen a password database and can test 100 billion guesses a second on graphics cards, and it uses the average case of half the possible combinations. Real attacks on well-protected sites are far slower because sites use slow hashing and lock accounts after failed logins, so treat the estimate as a worst case, not a promise.

The label follows the bits: under 40 is Very weak, 40 to 59 Weak, 60 to 79 Good, 80 to 99 Strong, and 100 or more Very strong.

Two things stand out. Length matters far more than adding symbols: going from 12 to 16 characters adds 25 bits, which multiplies the work by about 33 million. And a PIN is never strong on its own. It is only safe where the device locks or wipes itself after a few wrong tries, such as a phone or a bank card.

Passwords vs passphrases

A passphrase is several random words joined together, such as Tidy-Rumble-Canyon-Mascot-Oxygen. Each word is picked at random from the EFF Large Wordlist, which has 7,776 words, so each word adds about 12.9 bits. The words are chosen by the random generator, not by you, which is what makes them strong. A phrase you invent yourself, such as a song lyric, is much weaker than its length suggests.

Use a passphrase for the few passwords you must type or remember: your password manager's master password, your computer login and your phone backup. Six words is a sensible minimum, and seven or eight for the master password. Use random character passwords for everything else, since your password manager fills them in for you.

Passphrase options include 3 to 12 words, a separator (hyphen, space, period, underscore, none, or a random digit between words), capitalizing each word, and adding a number to one word. A random digit separator adds about 3.3 bits per gap, and the entropy shown includes it.

What current password guidance says in 2026

NIST, the US standards agency, updated its digital identity guidelines in SP 800-63B-4. The password rules for websites and apps that follow it are a useful checklist for your own habits too:

• Passwords used as the only login factor should be at least 15 characters. With a second factor such as an authenticator app, the minimum is 8.
• Sites should accept passwords of at least 64 characters, allow pasting, and work with password managers.
• Sites should not force mixtures of character types or make you change passwords on a schedule. They should make you change one when there is evidence it was exposed.
• Sites should check new passwords against lists of common and breached passwords.

In practice that means: make passwords long, make each one unique, store them in a manager, and turn on two-factor authentication for anything that holds money or customer data. Shopify supports two-step authentication on every staff account, so turn it on for everyone with admin access.

Worked examples

A new store admin login

Leave the defaults: 20 characters with all four types. You get something like q7R!vX2m_Hc9#tLp4eWz at 124.6 bits. Copy it into your password manager first, then into the signup form, so you never have to see it again.

A site that rejects some symbols

Some older banking and supplier portals only accept a few symbols. Delete the others from the Symbols to use box, for example keep only !@#. The pool drops from 75 to 65 characters, so a 20 character password falls from 124.6 to about 120 bits, which is still very strong. If a site allows no symbols at all, untick Symbols and add a couple of characters of length to make up the difference.

Wi-Fi for a shop or studio

Guests type Wi-Fi passwords by hand, so use a passphrase: 5 words with a hyphen separator and Capitalize each word ticked, such as Velvet-Humid-Cargo-Sprout-Ladle. It is 64.6 bits, easy to read off a card, and you can turn it into a scan-to-join code with our QR code generator.

Ten staff logins for a busy season

Set How many to 10, click Generate list and download the .txt file. Hand each person their own password through a secure channel, ask them to change it on first login, and delete the file afterwards.

How the generator picks each character

Randomness is the whole point, so here is exactly what happens when you click New:

1. The tool builds the pool of allowed characters from your checkboxes and symbol list, removing duplicates and, if you asked, the look-alike characters.
2. If At least one of each type is ticked, it first draws one character from each chosen type, so a site that demands a digit and a symbol accepts the result.
3. It fills the remaining length with characters drawn from the whole pool.
4. It shuffles the result with a Fisher-Yates shuffle, so the guaranteed characters are not always at the start.

Every draw uses 32-bit values from crypto.getRandomValues with rejection sampling. Values that would favor some characters over others are thrown away and redrawn, so every character in the pool has exactly the same chance. That avoids the small bias you get from the common shortcut of taking a random number modulo the pool size. Passphrase words and PIN digits are drawn the same way.

Store your passwords in a password manager

A strong password you cannot remember is only useful if something remembers it for you. A password manager stores every password in an encrypted vault, fills it into the right site, and warns you when a site you use appears in a known breach. Good options include the Passwords app built into Apple devices, Google Password Manager in Chrome and Android, and dedicated managers such as Bitwarden and 1Password, which also work across Windows, Mac, iPhone and Android.

1. Choose one manager and install it on your computer and phone.
2. Create its master password with this tool's Passphrase mode: 7 words, hyphen separator, capitalized. Write it on paper and keep it somewhere safe at home until you remember it.
3. Turn on two-factor authentication for the manager itself.
4. Change your most important passwords first: email, store admin, payment accounts, domain registrar, then ad accounts and suppliers.
5. For each one, generate a new password here, save it in the manager, then update the site.

Many sites now also offer passkeys, which replace the password with a key stored on your device and opened with your fingerprint, face or PIN. Where a service you use offers passkeys, they are worth turning on. Keep a strong password on the account as well, since recovery and other devices may still rely on it.

Where store owners get caught out

• Reusing one password. When any site you use is breached, attackers try the same email and password on Shopify, PayPal and Gmail. Unique passwords stop that chain.
• Weak email security. Your email can reset every other account. Give it the longest password and two-factor authentication.
• Shared staff logins. Give each staff member their own account with only the permissions they need, so you can remove one person without changing everyone's access.
• Passwords in spreadsheets or chat. A password manager with shared vaults is safer than a Google Sheet or a WhatsApp message.

Troubleshooting

The site says my password is too long

Some sites still cap length at 16 or 20 characters. Lower the slider to the maximum they allow and keep all character types on to get the most bits from each character.

The site says a character is not allowed

Remove that symbol from the Symbols to use box and click New. Spaces and quotes are not in the default set because they cause the most problems.

The strength label changed when I turned off a type

Fewer possible characters means fewer bits per character. Add length to compensate: each extra character with all types on adds about 6.2 bits.

"Pick at least one character type"

All four checkboxes are off. Tick at least one. If you want only digits, use the PIN mode, which also explains when a PIN is appropriate.

The passphrase word list did not load

The EFF list is a separate file loaded with the page. Refresh the page; if you use a strict content blocker, allow scripts from this site.

Once your admin accounts are secured, the rest of the store work is easier to automate. AM Jarvis's Product Importer connects to Shopify with the client ID and secret of an app you create, and to WooCommerce with REST API keys, so you never hand your admin password to it. For the other parts of running a small business, see our email signature generator and privacy policy generator.