Password Generator
Strong random passwords, with control over length and character types.
Generate a random password using your browser's cryptographic random number generator. Choose the length and which character types to include, and see an at-a-glance strength estimate.
How long should a password be?
Strength is measured in bits of entropy: the password length multiplied by log₂ of the number of characters it can draw from. With all four character sets on, this generator picks from 75 characters, so each character adds about 6.2 bits.
| Length | Letters + numbers | All four sets | Rating |
|---|---|---|---|
| 8 | ~47 bits | ~50 bits | Fair |
| 12 | ~70 bits | ~75 bits | Good |
| 16 | ~93 bits | ~100 bits | Strong |
| 20 | ~117 bits | ~125 bits | Strong |
To put that in perspective: an attacker making 10 billion guesses per second against a stolen password database would need about 14 hours on average to crack a random 8-character password, but tens of thousands of years for a 12-character one and far longer than the age of the universe for 16 characters. Length matters more than anything else — adding characters beats adding symbol types.
Recommended settings
- Email, banking and password manager master password: 16 characters or more, all sets on. Use a different one for each.
- Everyday accounts saved in a password manager: 16–20 characters, since you never type them.
- Sites that reject symbols: turn symbols off and add 2–3 extra characters to make up the difference.
- Wi-Fi passwords: 12–16 characters without symbols are easier to type on a TV or game console.
Good password habits
A strong password only helps if it's unique. Reusing one password across sites means a breach at one company exposes all your accounts, so generate a new password for every login and store them in a password manager. Turn on two-factor authentication for important accounts such as email and banking, and change a password straight away if a site tells you it's been breached.
Frequently asked questions
Is this actually random?
Yes — it uses your browser's Web Crypto API (crypto.getRandomValues), the same cryptographically secure random source used for encryption keys, not a simple Math.random() generator.
Is my generated password sent anywhere?
No. The password is generated and displayed entirely in your browser and is never transmitted to any server.
Why are some characters like l, 1, O, 0 excluded?
They're left out of the letter and number sets to avoid passwords that are easy to misread or mistype.
How many characters should a strong password have?
At least 12, and 16 or more for important accounts. A random 16-character password using upper and lowercase letters, numbers and symbols has about 100 bits of entropy, which is far beyond what brute-force attacks can crack.
Is a longer password better than adding symbols?
Usually, yes. Each extra character multiplies the number of possible passwords by the full size of the character set, while adding symbols only enlarges the set. A 16-character password of letters and numbers (~93 bits) is stronger than a 12-character one with symbols (~75 bits).
Should I write my passwords down?
A password manager is the safer choice — it stores long random passwords encrypted and fills them in for you. If you must write one down, keep it somewhere physically secure and never on a sticky note by your computer.