Creates strong random passwords or memorable passphrases using your browser’s cryptographic random number generator. Nothing is sent to a server.
Passphrases follow the Own Your Online advice of four or more random words. Store the result in a password manager rather than reusing it across sites.
The generator above runs entirely in your browser and uses your device’s cryptographic random number generator, the same source browsers use for encryption keys. Nothing you generate is sent anywhere, logged, or stored — reload the page and it is gone.
Passphrase or random password?
Both are strong when they are long enough, but they suit different jobs.
A passphrase of five random words is something you can actually remember and type on a TV remote or a game console. That makes it the right choice for the handful of passwords you must key in by hand: your password manager’s master password, your laptop login, your Wi-Fi.
A random password of 16 or more characters is stronger per character and impossible to remember — which does not matter, because your password manager types it for you. Use it for everything else.
| Type | Example shape | Roughly | Best for |
|---|---|---|---|
| 5-word passphrase | Copper-Meadow-Tulip-Rover-Quartz-47 | 54 bits | Master password, device login, Wi-Fi |
| 16-character random | k7Qv2mRt9XpL4zNb | 95 bits | Ordinary website logins, stored in a manager |
| 20-character random with symbols | Tf9!qZ2v#Lm4xR7@nBw% | 131 bits | Email, banking, anything that unlocks other accounts |
“Bits” is a measure of how many guesses an attacker needs. Each extra bit doubles the work. Anything above about 70 bits is beyond brute force with today’s hardware, which is why length matters far more than sprinkling in punctuation.
What the rules used to say, and what they say now
The old advice — eight characters, one capital, one number, one symbol, changed every 90 days — produced predictable passwords like Spring2026! and taught people to write them on sticky notes. The United States standards body NIST rewrote its guidance in July 2025, and the current version says the opposite:
- At least 15 characters where a password is your only protection, and at least 8 where you also use two-factor authentication.
- No forced composition rules, and no scheduled expiry — change a password only when there is evidence it has been exposed.
- Accept long passwords, spaces and pasting, so password managers work properly.
- Check new passwords against lists of already-breached ones.
New Zealand’s National Cyber Security Centre gives the same advice in plainer words: use a passphrase of four or more random words, use a different one everywhere, and let a password manager carry the load.
Why “random” has to mean random
A passphrase only works if the words are chosen by a machine. Four words you picked yourself — a pet, a street, a team, a year — are guessable from your social media. The generator above draws each word independently from a 771-word list, so a five-word phrase has about 48 bits of entropy before you add a number, regardless of how ordinary the words look.
Using what you generate
A generated password is only useful if you can retrieve it later, which is what a password manager is for. It fills logins across your devices, warns you about reuse, and keeps the vault encrypted so that even the provider cannot read it. Our password manager guide for New Zealand compares the main options, and the Bitwarden review covers the one with the most generous free plan.
Two habits matter as much as the password itself. Turn on two-factor authentication for your email first, because whoever controls your email can reset everything else. And check whether your existing passwords have already leaked — the Have I Been Pwned guide explains how that works and how to read the results.
Where passkeys fit
Passkeys replace the password with a key pair stored on your device and unlocked by your fingerprint, face or PIN. They cannot be phished or reused, and support is spreading in New Zealand — Inland Revenue’s myIR and Trade Me both offer them. Where a site supports passkeys, use them. Where it does not, you still need a long unique password, which is where this page comes in.
Disclaimer
General information only. Nothing typed into this page is transmitted or stored; if you are recovering from a suspected account compromise, report it to the NCSC on 0800 114 115.
Reference sources
Frequently asked questions
Is this password generator safe to use?
The generator runs in your browser using the built-in cryptographic random number generator. No password is sent over the network, written to storage, or visible to us. You can disconnect from the internet, generate one, and it still works.
How long should a password be in 2026?
At least 15 characters when it is your only protection, or a passphrase of four to five random words. Where two-factor authentication is switched on, shorter is tolerable, but there is no reason to go short when a manager remembers it for you.
Are random words really as strong as symbols?
Yes, if the words are machine-chosen and there are enough of them. Five words from a 771-word list gives about 48 bits; adding a number and a capital takes it past 55. A seven-character password with symbols is nowhere near that.
Should I change my passwords every three months?
No. Current NIST guidance tells organisations to stop forcing routine changes, because it pushes people towards predictable variations. Change a password when a service reports a breach, when a check shows it has been exposed, or when you have shared it.
What should I use for my Wi-Fi password?
A passphrase works best, because you will read it out to visitors and type it on devices without keyboards. Twenty characters or more on WPA2 or WPA3 puts it out of reach of offline cracking.
Can I reuse one strong password everywhere?
No. Reuse is what turns one company’s breach into a problem across all your accounts, because attackers replay leaked pairs against other sites. A manager makes unique passwords no harder than reused ones.
