Password Generator

Generate strong random passwords with the length and characters you choose. Passwords are created in your browser using your device’s secure random number generator and are never sent or stored. Longer is stronger: 16 characters is a good default.

How to use the Password Generator

1. Choose the length and which character types to include.
2. Pick how many passwords you want and whether to avoid look-alike characters.
3. Press Generate password, copy it, and save it in a password manager. Generate again for a new one.

Formula and method

Strength is measured in bits of entropy: entropy = length × log₂(pool size). With all four character types (about 85 symbols in the pool), a 16-character password has about 102 bits. Each added bit doubles the number of guesses an attacker needs. Randomness comes from the browser’s crypto.getRandomValues, with rejection sampling so every character is equally likely.

How long should a password be?

NIST guidance (SP 800-63B) recommends length over complexity rules and advises against forced periodic changes: use long, unique passwords and change one only if you suspect it was exposed.

Good password habits

Use a different password for every account, store them in a reputable password manager, and turn on two-factor authentication where available. Avoid personal information, keyboard patterns and reused passwords. If a service breach is announced, change that password and any account that shared it.

How long would a brute-force attack take?

These times assume an attacker who stole a password database and can test 10 billion guesses per second against a fast hash. Slow, well-designed password hashing makes attacks far slower, and reused or common passwords fall in seconds whatever their length. A random password of 12 or more characters, unique to one account, is out of reach of this kind of attack.

Frequently asked questions

Is this password generator safe?

Passwords are generated entirely in your browser with the Web Crypto API and are never transmitted or stored.

How long should my password be?

At least 12 characters for ordinary accounts and 16 or more for email, banking and your password manager.

Should I include symbols?

Symbols add entropy, but length matters more. Some sites reject certain symbols, so adjust if a site complains.

Is a passphrase better than a random password?

A random passphrase of five or six words is long and easier to remember, and it is strong if the words are chosen at random. For accounts you do not type often, a manager-generated random password is best.

Should I change my passwords regularly?

NIST advises against forced periodic changes. Change a password if you think it was exposed, and use a different one for every account.

What should I do if my password was in a data breach?

Change it right away on that site and on any other account that used the same password, and turn on two-factor authentication.

Sources

• NIST SP 800-63B: Digital Identity Guidelines

Related calculators

• Character Counter
• Random Number Generator
• Word Counter
• Coin Flip

Browse all calculators