Generate an emoji password

What the number next to it means

Entropy is the size of the haystack, measured in bits. Each extra bit doubles the number of guesses an attacker has to make. This generator picks each emoji independently and uniformly from a set of 546, which is worth about 9.1 bits per emoji — against 5.2 bits for a random character drawn from lowercase letters plus digits, and 12.9 bits for a whole word drawn from the 7,776-word Diceware list.

That comparison only holds because these emoji are drawn at random rather than chosen. An emoji password you thought up yourself is worth far less: people reach for the same few dozen faces, hearts and hand signs, and whoever is guessing knows which ones.

Where an emoji password breaks

This is the part most generators leave out, and it is the part that decides whether you should use one.

• The field may reject it outright. Plenty of sign-up forms validate passwords against a plain ASCII pattern and refuse anything else, sometimes with an error that does not say why.
• Worse, it may accept it and store something else. An emoji takes up more room than a letter does, so a system that cuts a password off at a fixed length, or was never built to hold emoji at all, can save a mangled version — which then does not match what you type at the next login.
• You may not be able to type it back. A password you can only paste is a password you cannot enter on a console, a locked screen, a games machine, or a phone whose keyboard offers a different emoji set.
• Skin tones and variation selectors are invisible. The same face with a different modifier is a different string, and nothing on screen tells you which one you have. This generator avoids the sequences where that bites.

So: for an account you cannot afford to lose, use a password manager and let it generate a long random ordinary password. Reach for emoji where you type the secret yourself and control the field — and test the login once, immediately, while you still have a session open.

It is generated here, not fetched

Everything here happens on your own device. The emoji come from the same set as the emoji palette, the randomness comes from your own browser, and the password is never sent anywhere — there is nothing that could carry it away and nothing that keeps a copy. Privacy covers the rest of the site on the same terms.