Which one should you use?

Random passwords are for accounts your password manager fills in for you: maximum strength per character, and you never type them. Passphrases are for the handful of secrets a human actually has to type or say out loud: your laptop login, the Wi-Fi, the password manager's own master password. Five random words are far stronger than something you invent, and far easier to type than r8$Kq2!v.

The strength meter shows entropy: how many guesses an attacker would need on average. Anything past roughly 60 bits is out of reach for online guessing; 70+ holds up even against offline cracking of a stolen database. Length beats cleverness every time.

How this works. Passwords are generated on your device with your browser's cryptographic random number generator (crypto.getRandomValues); the passphrase words come from the EFF short wordlist. Nothing is sent to us or anyone else, and we could not see it if we wanted to. Honest note: your password manager should normally generate these for you. This tool is for the odd case, a router admin account, a Wi-Fi passphrase, a service that fights your manager. Generate it, then store it in the manager, not on a sticky note. New to this? Read our guide to passwords and passkeys for small business or take the Founder IT quiz.

Passwords are still your front door

Most small-business breaches still start with a stolen or reused password. A generator helps, but the durable fixes are a password manager for the whole team, MFA everywhere it matters, and passkeys where you can use them. We help Canadian small businesses put that in place: assessed, rolled out, and documented.