Make a strong password, a passphrase you can actually remember, or an anonymous username, and check whether a password you already use has turned up in a data breach. Everything happens in your browser: we never see what you generate or type.
The strength check runs on your device. Check for leaks scrambles the password with SHA-1 and sends only the first 5 of its 40 characters to Have I Been Pwned's Pwned Passwords service, which returns hundreds of possible matches (padded with decoys); the comparison happens here. Your password never leaves this page.
Runs in your browser. Passwords are generated on your device; the leak check sends only the first 5 characters of a scrambled (SHA-1) version of a password, never the password itself.
Family Safe Word GeneratorWhat makes a password strong
Length beats complexity. Criminals don’t guess passwords one at a time by hand; they run lists of leaked passwords and common patterns through software that tries billions of combinations a second. A short password with a capital, a number and a symbol (Summer2024!) falls in seconds because thousands of people have used the same pattern. A long, random one doesn’t.
That’s why current guidance, including the US standards body NIST’s 2025 digital identity rules, asks for long passwords and checks against known breached passwords, and drops the old “must contain a symbol” rules. The generator above defaults to 20 random characters. The strength figure is entropy in bits: each extra bit doubles the guesses needed. Above about 80 bits, a password is out of reach of any realistic attacker.
Password or passphrase?
Use a random password for anything a password manager fills in for you. Use a passphrase for the few things you must type from memory: your password manager’s main password, your computer login, your phone backup.
Passphrases here use the Electronic Frontier Foundation’s list of 7,776 words chosen to be easy to spell and type. Each random word adds about 12.9 bits, so six words give roughly 77 bits: as hard to crack as a random 12-character password, but far easier to remember. The words must be picked at random, which is why a generator beats inventing your own: people choose song lyrics and famous quotes, and those are in the attackers’ lists too.
How the leak check keeps your password private
The “Check a password” tab tells you whether a password appears in Have I Been Pwned’s Pwned Passwords collection, the passwords exposed in public data breaches. If it’s in there, it’s on the lists criminals try first, however strong it looks.
The check never sends your password. Your browser turns it into a SHA-1 hash, a 40-character fingerprint, and sends only the first 5 characters. The service replies with every leaked hash that starts the same way (hundreds of them, padded with decoys so even the response size reveals nothing), and your browser looks for a match itself. Neither we nor Have I Been Pwned can tell which password you checked. The strength rating also runs on your device.
If the leak service can’t be reached, the tool says it couldn’t check. It never shows “not leaked” unless the check actually ran.
Usernames that don’t give you away
Reusing a username is one of the easiest ways to link your accounts together. Someone who finds your handle in one breach can search for it everywhere else, and old forum posts, gaming profiles and reviews quickly add up to a real name and address. The username generator combines a random adjective, a random noun and an optional number, with nothing that relates to you. Use a different one wherever you want to keep part of your life separate.
After you’ve made a new password
- One password per site. Reuse is how a breach at one company becomes access to your email or bank. A password manager remembers them for you.
- Turn on two-factor authentication, ideally an authenticator app, a security key or a passkey rather than SMS.
- Change leaked passwords first, starting with your email account, because it can reset everything else.
- If malware stole your passwords, clean the device first. New passwords typed on an infected computer are stolen again. See infostealer logs explained.
Got a breach alert and not sure where to start? Read what to do if your data is on the dark web.
Password generator FAQ
Is it safe to generate a password on a website?
It is when the password is created on your device and never sent anywhere, which is how this tool works. It uses your browser's built-in secure random number generator (crypto.getRandomValues), and the page is locked down so it can only talk to this site and the Pwned Passwords service. If your browser doesn't offer secure randomness, the tool refuses to run instead of falling back to something weaker.
How long should my password be?
For a random password stored in a password manager, 16 to 20 characters or more. For a passphrase you type from memory, six random words or more. Length matters far more than adding symbols.
Does the leak check send my password to anyone?
No. Your browser turns the password into a SHA-1 hash and sends only the first 5 of its 40 characters to Have I Been Pwned's Pwned Passwords service. It returns hundreds of possible matches, padded with decoys, and your browser does the comparison. Nobody can tell which password you checked.
My password wasn't found in any leaks. Is it safe?
Not necessarily. "Not found" only means it isn't in the published breach lists. It can still be weak (look at the strength rating) or already reused somewhere that hasn't been breached yet. Use a unique, randomly generated password for every account.
What does "entropy in bits" mean?
It measures how many guesses a password could take. Every extra bit doubles the number. Under about 45 bits is weak, 64 bits or more is strong, and 80 bits or more is beyond any realistic attack. The crack-time figure assumes a well-equipped attacker making 100 billion guesses a second against a stolen, fast-hashed password list.
Why are there no symbols in my passphrase?
They aren't needed. Six random words already give about 77 bits of entropy. If a site insists on capitals or a number, tick the extra options; they add a little strength but the words do the real work.