Pronounceable Password Generator

The Pronounceable Password Generator builds passwords out of letters you can say. Instead of drawing every character from the full keyboard, it draws letters alternately from consonants and vowels, so close to half the letters in each result are vowels, and then adds exactly one capital letter, one digit and one symbol so the result passes the usual "must contain" rules. Pick a length from 4 to 40, pick how many you want, and each one appears on its own card with a copy button.

What goes into each password

Every password contains, in a shuffled order:

• one uppercase consonant (B through Z, never a vowel)
• one lowercase vowel (a, e, i, o or u)
• one digit, 0 to 9
• one symbol from the set #?!@$%^&*-
• the remaining positions filled with lowercase letters that alternate consonant, vowel, consonant, vowel

So an 8-character password has three consonants, three vowels, a digit and a symbol; a 12-character one has five consonants, five vowels, a digit and a symbol. The digit and symbol counts never grow with length, which is what keeps long passwords from turning into line noise. The order is shuffled after assembly, so you will not get a strict consonant-vowel rhythm across the whole string; you get something like e3Kub!ta rather than Kubeta3!. It reads more easily than a fully random string, though it is not a made-up word.

Settings

• Password length: 4 to 40 characters. Four is the minimum because each password needs one of each character type. The default is 8.
• Number of passwords: any number from 1 up; the default is 10, and generating 50 or 100 at a time is fine.

How strong is a pronounceable password?

Restricting the letter pattern reduces the number of possible passwords, so a pronounceable password is always weaker than a fully random one of the same length. The fix is simple: use more characters. At 8 characters the results are fine for a throwaway account but not for email or banking. At 12 to 16 characters the pool of possibilities is large enough for most accounts, and at 20 or more you are well past what an online guessing attack can reach. If the site allows it and you are storing the password in a manager anyway, use the Random Password Generator instead, which draws from the full character set. If you want something you can memorize as words rather than sounds, the Memorable Password Generator is the other option on this site.

Passwords are generated in your browser with JavaScript's Math.random, which is not a cryptographic source. That is acceptable for the kinds of use below; for keys, tokens or anything protecting money, generate the secret in a password manager.

Where these fit

• Passwords you have to say out loud. Wi-Fi keys for guests, a temporary login you read to a colleague over the phone, a password written on a whiteboard in a training room. Vowel-rich strings survive being spoken; xq7$Zk does not.
• Initial passwords for new accounts. IT teams that hand out a first-login password and force a change. Generating 50 at once covers a whole onboarding batch.
• Test users and demo data. Seed a staging database with logins that a tester can type without copy-paste.
• Kids' and shared-device accounts. Something a ten-year-old can type on a tablet keyboard but that still passes a complexity check.

Once you have a password you like, you can see its hashed form with the SHA256 Hash Generator or MD5 Hash Generator, which is handy when you are seeding a test database that stores hashes. The rest of the set is under all developer & test data tools.