Password Generator
Build a random password from the character types you allow. Everything is generated in your browser with the Web Crypto API, so nothing is sent anywhere, and you can see the entropy in bits and a plain-English strength rating instead of a vague bar.
Enter your details above — results update as you type.
Formula and calculation
Worked example
A 16-character password with all four character types is drawn from a pool of 88 characters, which is 103.35 bits of entropy — rated Very strong. Switching on the look-alike filter drops the pool to 83 characters and costs about 1.3 bits, because removing five characters out of 88 is a rounding error in an exponent.
Getting the most out of a generated password
The strongest password is one you never see twice: generate it, save it in a password manager, and let the manager type it for you. When a human has to read it — a Wi-Fi key, a device passcode, a login on a borrowed computer — turn on the look-alike filter so I, l, 1, O and 0 cannot be misread.
Length is the cheaper lever. Adding characters multiplies the attacker's work, while swapping one symbol set for another only nudges it: each symbol character is worth about half a bit more than a letter. That is why 16 characters from 88 characters is rated Very strong while 8 from the same pool is Weak, and why a 20 character password beats a 12 character one with every symbol you can find.
What the results mean
- Password
- The generated password, drawn from your character pool with the browser's cryptographic random source. Copy it and store it in a password manager — it is created locally and never sent anywhere.
- Entropy
- The password's entropy in bits, from length × log2(pool size). Each extra bit doubles the work an attacker faces, so this number is the honest measure of strength — far more useful than counting how many character types you used.
- Strength
- A word for the entropy, using this tool's cut-offs: under 60 bits is Weak, 60 to 79 Fair, 80 to 99 Strong, and 100 or more Very strong. The cut-offs assume a fast GPU rig trying a trillion guesses a second and finding the password halfway through the keyspace on average: 60 bits falls in about a week, 80 bits takes thousands of years, and 100 bits is out of reach for any foreseeable machine.
- Character pool
- How many characters the generator chooses from — 26 uppercase plus 26 lowercase plus 10 digits plus 26 symbols makes 88, or 83 with the look-alike filter on. Switching a character type off shrinks the pool and costs entropy.
- Made up of
- The pool broken down by the character sets you ticked, so you can see exactly what the password is made of.
Frequently asked questions
How strong is a 16 character password?
Random 16 characters from all four character types come from a pool of 88, which is 16 × log2(88) = 103 bits — rated Very strong here. Brute forcing that at a trillion guesses per second would take far longer than the age of the universe. The catch is the word random: a 16 character phrase you invented yourself carries far less.
Should I include symbols in my password?
They add 26 characters to the pool, worth about half a bit per character compared with letters and digits alone. The bigger reasons to keep them on are that many sites demand a symbol and that one or two break naive dictionary rules. If a site rejects symbols, add two characters instead — length pays better.
Is it safe to generate a password on this page?
Yes. The password is built by your own browser with crypto.getRandomValues and never leaves your device; nothing is submitted and no copy is stored here. The same design means it cannot be recovered for you: if you lose it, generate a new one and update the account.
Why would I exclude look-alike characters?
The letter I, the letter l, the digit 1, the capital O and the digit 0 look alike in many fonts, and misreading one when you type a password from a note wastes an attempt. Excluding all five costs about 1.3 bits at 16 characters — a fair trade for anything a person has to retype, and pointless for passwords a manager fills in.
Is a passphrase better than a random password?
For anything you have to remember or type by hand, usually yes. Four words picked at random from a 7,776 word list is about 51.7 bits, and five words is about 64.6 bits, with far less typing pain than 12 random characters. Use a generated random string wherever a password manager can paste it for you.