Tool
Password generator
Strong passwords built the way Australia's cyber security agency recommends: random words, long enough, with a few capitals and numbers dropped in at random spots. Made in your browser, and never sent or saved anywhere.
Nothing you enter here is sent or saved. Privacy policy
How strong is it?
- Strength
- -
- Randomness
- -
- Made of
- -
- Time to guess
- -
- Length
- -
Time to guess assumes an attacker who knows exactly how the password was made and tries ten billion guesses a second, taking on average half the possibilities. Sites that store passwords properly are far tougher than that.
Against the ISM
Where the rules come from
This follows guidance from the Australian Signals Directorate's Australian Cyber Security Centre (ACSC). It isn't an ACSC product and they haven't endorsed it. Read the sources for the real wording:
- ACSC: Set secure passphrases. A passphrase is 4 or more random words, at least 15 characters, and different for every account.
- ACSC: Creating strong passphrases. Long, unpredictable and unique. It also warns that a sentence is predictable.
- Information Security Manual, guidelines for system hardening (authentication hardening). ISM-0421: at least 4 random words and 15 characters. ISM-1557: 5 words and 17 characters for SECRET systems. ISM-0422: 6 words and 20 characters for TOP SECRET. ISM-1558: no categorised lists, real sentences or song lyrics. ISM-1596: never reuse one across systems.
- The ISM points to the EFF's long word list for making passphrases, which is the list used here (7,776 words, by Joseph Bonneau for the Electronic Frontier Foundation, CC BY 3.0 US).
About the capitals and numbers. The ACSC doesn't ask for them. Its own example of a weak password, "Admin1", had a capital and a number. What counts is length and randomness. They're added here because some sites insist on them, and they do add extra randomness. The word count and length are what the ISM minimums are about, and every setting here meets them.
The wording above follows the ISM's September 2025 edition. The ISM is updated every quarter, so the links are the source of truth.
Using it well
One per account. Reusing a password is the fastest way to turn one leak into many. A password manager makes this painless, and the ISM's advice is to store them in one.
Don't keep rolling until you find one you like. Picking your favourite from a pile quietly shrinks the pool of possibilities. Take the first one.
Mind the clipboard. Copying puts the password where clipboard managers can hold on to it. Pasting straight into your password manager is safest.
Nothing leaves this page. The password is made from your browser's secure random number generator, and the site blocks any request that isn't to itself. Open your browser's network tab and watch nothing happen.