Emoji Password Generator

Only a little per character. A random emoji from this page’s pool of 238 gives about 7.9 bits, while a random character from the 88 letters, digits and symbols gives about 6.5 bits. Three emojis therefore add roughly four more bits than three ordinary characters. What matters most is that every character is chosen at random and that the password is long enough, so check the entropy shown by the meter rather than counting emojis. Randomly generated passwords are also not at risk from dictionary attacks, whether or not they contain emojis.

Use it for accounts on modern websites and apps that accept Unicode, ideally with a password manager that fills it in for you. Avoid it for anything you must type before an emoji keyboard exists: disk encryption, BIOS and boot prompts, some WiFi and router screens, and old systems. Test a new emoji password by logging out and back in before you rely on it. Newer emojis may also show as empty boxes on older devices, although the stored value is unaffected.

Systems count passwords differently. An emoji is one character to a person, but 1 to 3 units in UTF-16 (the way JavaScript counts a string) and 3 to 7 bytes in UTF-8. A site that limits password length by characters, units or bytes will see different numbers for the same password. The most important limit is bcrypt, which only reads the first 72 bytes: anything after that is silently ignored, which would make a long emoji password weaker than it looks. The page warns you when a password goes over 72 bytes.

Random takes every emoji from all the categories you selected. Themed picks one category at random and takes all the emojis from it, so a password might use only animals or only food, which can be easier to remember. Themed passwords are weaker because the attacker only has to search the smaller themes first, so the page lowers its estimate to account for that.

The page counts the exact number of passwords that its method can produce: the ways to place the emojis, the ordinary characters (with the “at least one of each type” rule taken into account exactly, using big-number arithmetic) and the emoji choices. The result is the base-2 logarithm of that count. Time to crack assumes the attacker searches half of all possibilities at the speed of the attack you choose: 100 guesses per second online, 10,000 per second against a slow hash, or 1 trillion per second against a fast hash.

No. Earlier versions of this page inserted emojis at positions counted in UTF-16 units, and in tests that cut an emoji in half in about one password in five. This version builds the password from whole characters and then checks it with the browser’s grapheme segmentation (Intl.Segmenter) to confirm that every character is still exactly what was chosen. Emojis that could merge with a neighbour, such as skin-tone modifiers on their own, are not accepted.

Tick Custom emojis and paste any emojis, with or without spaces between them. Each emoji, including skin-tone, family and flag emojis, counts as one. Anything that is not an emoji is ignored, duplicates are removed, and emojis that change under Unicode normalization (some sites normalize passwords) are skipped, because they could not be typed back reliably. Custom emojis are only used while the box is ticked.

No. Passwords are generated in your browser with the Web Crypto API, the page’s content security policy blocks outgoing network requests, and nothing is saved: there is no history, and the only thing kept in local storage is your language choice. Earlier versions of this page loaded a script from an outside server; this version loads none.