Password Generator

Generate strong, secure passwords with customizable length, character types, and multi-word passphrases.

Password Generator tool

Loading...

Example

Input: Length 16 with uppercase, lowercase, numbers and symbols enabled, then Generate Password

Result: A new random 16-character password using all four character types, rated Strong with 103 bits of entropy

Characters are drawn with crypto.getRandomValues from an 88-character set, so entropy is 16 x log2(88) = 103 bits. The password is different every time you generate.

Password Entropy by Length and Character Set

LengthLowercase onlyLetters and digitsAll four types
837 bits (Weak)47 bits (Fair)51 bits (Fair)
1256 bits (Fair)71 bits (Good)77 bits (Good)
1675 bits (Good)95 bits (Strong)103 bits (Strong)
2094 bits (Strong)119 bits (Strong)129 bits (Very Strong)
24112 bits (Strong)142 bits (Very Strong)155 bits (Very Strong)
32150 bits (Very Strong)190 bits (Very Strong)206 bits (Very Strong)

Computed with this generator: length x log2(pool), with pools of 26, 62 and 88 characters, and its own strength labels. Passphrases add about 12.9 bits per word: 6 words give 77 bits (Good) and 7 words give 90 bits (Strong).

  1. Set the password length (8 to 128 characters) with the slider.
  2. Turn character types on or off: uppercase letters, lowercase letters, numbers and symbols.
  3. Or switch to Passphrase mode to make a password from random words.
  4. Click the generate button to create a new password.
  5. Copy the password to your clipboard with the copy button.
  6. To make several at once, set Number of Passwords (up to 50).

How Long Should a Random Password Be?

This password generator makes random passwords and passphrases in your browser. For most accounts, a 16-character password that mixes all four character types is plenty. It carries about 103 bits of entropy, far more than any brute-force attack can get through.

Entropy measures how many guesses a password could take, counted in bits. Each extra bit doubles the work. The tool works it out from your settings: length times log2 of the pool size. With all four types the pool has 88 characters (26 uppercase, 26 lowercase, 10 digits and 26 symbols), so each character adds about 6.5 bits. Length matters most. Going from 12 to 16 characters adds 26 bits, which makes a brute-force attack about 67 million times harder. The tool also makes sure every type you switch on appears at least once.

Passphrase mode joins random words with a separator you pick, such as cider-plank-overhang-wobbly-snooze-atlas. Passphrases are easier to remember and to type on a phone. The words come from the EFF large word list, which has 7,776 words, so each word adds about 12.9 bits. The default of 6 words gives 77 bits, which the tool rates Good and is what the EFF suggests. Use 7 words (90 bits, Strong) or more for a password manager master password.

Every character comes from crypto.getRandomValues, the secure random source built into your browser, and nothing is sent or saved. You can make up to 50 passwords at once. Keep them in a password manager, not a text file. To test a password you already use, try the Password Strength Checker. If you need an API key rather than a login, the Token Generator is a better fit.

Sources

Frequently Asked Questions

Use at least 16 random characters for anything important. NIST SP 800-63B-4 sets 15 characters as the minimum when a password is the only thing protecting an account. With all four character types, 16 characters gives 103 bits here and is rated Strong. Past about 20 characters you mostly gain extra margin rather than practical safety.
No, length usually wins. In this tool, 16 lowercase letters give 75 bits, while 12 characters using all four types give 77 bits. So four extra plain letters do about as much as adding capitals, digits and symbols. Many sites still require a mix of types, so leave them on, but make the password longer first.
Yes, at the default of 6 words or more. The tool uses the EFF large word list of 7,776 words, which gives about 12.9 bits per word. Four words give 51 bits, fine for low-value logins but weak against offline guessing. Six words give 77 bits and seven give 90 bits, which is strong enough for a master password. Every word is picked with the secure random source in your browser.
Here the password is made on your device with the Web Crypto API and is never sent over the network or stored. The page cannot see it after you leave. The main risk is your own device: a browser extension or malware could read the screen or clipboard. On a machine you trust, this is as safe as a desktop generator.
Not by default. NIST guidance says services should not force regular password changes, because people respond with small, predictable edits. Change a password when there is a reason: the site reports a breach, you reused it somewhere, or you think someone saw it. A unique, long password per site matters far more than frequent changes.

Related Tools

Password Strength Checker

Check how strong your password is with a visual meter, entropy score, and estimated crack time.

Security and Encryption

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files right in your browser.

Developer Tools

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption

Bcrypt Hash Generator and Verifier

Generate bcrypt hashes with configurable rounds and verify passwords against existing bcrypt hashes.

Security and Encryption

Token Generator

Generate random tokens and strings in hex, alphanumeric, URL-safe, and custom character set formats.

Security and Encryption

BIP39 Mnemonic Generator

Generate BIP39 mnemonic seed phrases for cryptocurrency wallets in 12, 15, 18, 21, or 24 words.

Security and Encryption