Password Generator
Choose a length and the character types to include, and a new password appears instantly. Everything is generated on your device with a cryptographically secure random source.
Your password
Generating…
- Entropy
- 104 bits
- Possible combinations
- 89¹⁶
- Time to crack (offline, 10 billion guesses/s)
- 25 trillion years
How this password generator works
Every character is drawn uniformly at random from the pool you select, using your browser's crypto.getRandomValues function. That is the same cryptographically secure random source the browser uses for TLS encryption, so the output is unpredictable in a way that Math.random() and human-invented passwords are not. When more than one character type is selected, the generator guarantees at least one character of each type and then shuffles the result so the guaranteed characters do not sit at the front.
Generation happens entirely on your device. The page never sends what it produces anywhere, and there is no history or log of previous passwords.
Password entropy explained
The strength of a random password is measured in bits of entropy. If a password is L characters long and each character is chosen from a pool of N possibilities, the number of equally likely passwords is NL, and the entropy is:
bits = L × log₂(N)
Example: 16 characters from all four classes (26 + 26 + 10 + 27 = 89 symbols) gives 16 × log₂(89) = 16 × 6.48 ≈ 104 bits. Each extra bit doubles the number of guesses an attacker must make, so adding four characters to a password roughly multiplies the work by 2⁶ × 2⁶ × 2⁶ × 2⁶, more than a million times.
| Entropy | Rating | Typical example |
|---|---|---|
| Under 28 bits | Very weak | 6-digit PIN, a dictionary word |
| 28 – 35 bits | Weak | 8 lowercase letters |
| 36 – 59 bits | Fair | 8 mixed characters |
| 60 – 99 bits | Strong | 12 – 14 mixed characters |
| 100 bits and up | Very strong | 16+ mixed characters |
How to use this generator
- Pick a length with the slider. 16 is a good default; use 20 or more for master passwords and encryption keys.
- Untick any character type a website refuses. Make the password longer to compensate.
- Click Copy next to the password and paste it into your password manager or the sign-up form.
- Need several at once, for example for a batch of new accounts? Set "How many to generate" up to 20.
Tips for strong passwords
- Never reuse a password. A breach on one site is immediately tried on every other popular service.
- Longer beats cleverer. Substitutions like "P@ssw0rd" are the first thing cracking tools try.
- Use a password manager so random passwords are practical. You only have to remember one strong master password.
- Turn on two-factor authentication wherever it is offered. It protects you even if a password leaks.
- PINs are only as safe as the lockout. A 6-digit PIN has about 20 bits of entropy; it works because phones and cards limit the number of attempts.
Frequently asked questions
Is it safe to use an online password generator?
This one runs entirely in your browser using the Web Crypto API, the same cryptographically secure random source browsers use for encryption. Nothing you generate is sent to or stored on a server. If you prefer, you can disconnect from the internet after the page loads and it will keep working.
How long should a password be?
For anything important, 16 characters or more with all four character types gives around 100 bits of entropy, which is beyond practical brute force. Many security guidelines now recommend at least 12 to 14 characters. The length matters more than any individual symbol, so when a site limits symbols, make the password longer instead.
What do the entropy bits and time-to-crack mean?
Entropy measures how many equally likely passwords the generator could have produced; each extra bit doubles that number. The crack time assumes an attacker with the password hash can test 10 billion guesses per second, which is realistic for a fast hash on modern GPUs. Online attacks against a login form are thousands of times slower.
Should I exclude ambiguous characters?
Only if you expect to read the password aloud or type it by hand from paper, where I, l and 1 or O and 0 are easy to confuse. Excluding them removes a few characters from the pool, which costs well under one bit of entropy per character, so the password stays strong.
How should I store the passwords I generate?
Use a password manager. It stores each password encrypted, fills it in for you and lets you use a different random password for every site, which is the single biggest improvement most people can make to their security.