Strings random words into a passphrase that is easy to read aloud and type, and hard to guess. Choose 3 to 10 words and a separator; it all happens in your browser.
Your browser's crypto engine draws true randomness — no server ever sees the result.
Dial in length, character sets, or switch to a memorable passphrase or numeric PIN.
One click to the clipboard, wiped again after 60 seconds — paste it straight into the sign-up form.
Not an ad-funded tool. Everything here exists to make your credentials genuinely unguessable.
Backed by crypto.getRandomValues — the same source browsers trust for encryption keys.
A five-segment meter scores every result in real time as you change the controls.
Three modes, each with their own controls — random strings, readable phrases, numeric codes.
8 to 64 characters, per-set toggles, ambiguous-character filtering, custom separators.
Credly’s apps, extension and CLI use this exact generator, so what you make here is what your vault makes.
Copied passwords wipe from the clipboard after 60 seconds, so nothing lingers.
Average time to brute-force a random password of upper- and lowercase letters, digits and symbols (75 characters), for an attacker making a trillion guesses a second.
Upgrade only when you want Credly to store, sync, and watch over what it makes.
Share credentials across your team — without ever holding anyone's secrets on our servers.
Give each team its own vault, with owner, admin, member and viewer roles.
Share a single login read-only or editable with a teammate, and revoke it any time.
An append-only record of changes and API-token use on every account.
A full CLI, scoped API tokens, secret injection with credly run, and an SSH agent.
A passphrase is a password made of several random words, such as film-ford-fair-edge-folk-fish-fade-flow. Because the words are picked at random rather than by you, an attacker has to try every possible combination.
Eight or more for anything important. Each word from Credly's 549-word list adds about 9.1 bits, so eight words give about 73 bits: around 130 years on average to brute-force at a trillion guesses a second. Five words fall in under a minute at that rate.
It depends on where you type it. A passphrase is easier to remember and type by hand, so it suits a master password, a computer login or a Wi-Fi key. A random password packs more strength into each character, so it is the better pick wherever a password manager fills it in for you.
Yes. Each word is drawn with your browser's Web Crypto API, with every word equally likely, and nothing is sent to us or stored. Words you choose yourself are far weaker, because people pick predictable words and patterns.
Yes, that is what passphrases are best at. Use eight words or more, never reuse it anywhere else, and keep your Credly Recovery Kit somewhere safe.
Credly stores your passwords end-to-end encrypted, autofills them everywhere, and flags the weak ones before attackers do.