How to use
- Set the length with the slider or the number field. 16 characters or more is a good default for passwords kept in a password manager.
- Choose the character types: uppercase, lowercase, digits and symbols. "Use every selected type" is on by default and puts at least one of each into every password.
- If needed, exclude similar characters such as l, 1 and O, ambiguous symbols, or specific characters a site rejects.
- Click Generate, check the strength label and entropy, then copy one password or all of them.
What makes a password strong
For a randomly generated password, strength is measured as entropy: length × log2(pool size) bits, where the pool is the set of characters it is drawn from. Each extra bit doubles the number of guesses needed. Length multiplies the entropy, while a bigger pool adds only a little per character, so length wins: a 16-character lowercase password has about 11 million times more possibilities than an 8-character one that mixes all four types.
| Length | Characters | Pool | Entropy |
|---|---|---|---|
| 4 | Digits (a PIN) | 10 | 13.3 bits |
| 8 | Lowercase | 26 | 37.6 bits |
| 8 | All four types | 89 | 51.8 bits |
| 12 | Letters and digits | 62 | 71.5 bits |
| 16 | Lowercase | 26 | 75.2 bits |
| 16 | All four types | 89 | 103.6 bits |
| 20 | All four types | 89 | 129.5 bits |
All four types give a pool of 89 here: 26 + 26 + 10 + 27 symbols. The tool shows entropy rounded down to whole bits. The figures hold only for random passwords; one a person makes up has far less entropy than its length suggests.
What NIST SP 800-63B recommends
NIST SP 800-63B, the US federal guideline for digital authentication, addresses the services that check passwords. Its current revision, SP 800-63B-4, says they:
- must require at least 15 characters when the password is the only factor, or 8 alongside another factor, and should allow at least 64 characters;
- must not impose composition rules such as "one uppercase letter, one digit and one symbol", nor periodic changes, but must force a change when there is evidence of compromise;
- must check new passwords against a blocklist of commonly used, expected or compromised passwords;
- should accept all printable ASCII characters and the space, and allow pasting so that password managers work.
For users the lesson is the same: length and randomness matter; predictable substitutions such as P@ssw0rd1 do not.
Password managers and passphrases
A reused password is often a bigger risk than a short one: after a breach, attackers try the leaked email and password pairs on other sites (credential stuffing). Use a different random password for every account and let a password manager remember them; a 20-character password then takes no more effort than an 8-character one.
For the few passwords you type from memory, such as the manager's master password, a passphrase is easier: words picked at random, for example with dice and the EFF long word list. Each word from its 7,776 entries adds about 12.9 bits, so six words give about 77.5 bits. This tool creates character passwords, not passphrases; for API keys and other machine secrets, use the random Base64 generator.
How this generator works
Passwords are created on your device with crypto.getRandomValues(), the browser's cryptographically secure random number generator, and are never sent or stored. A plain modulo would make some characters slightly more likely, so the tool uses rejection sampling: 32-bit random values at or above the largest multiple of the pool size are drawn again, and every character is exactly equally likely.
Exclude similar characters removes i l 1 L o 0 O, useful when a password is read aloud or typed from paper, as with Wi-Fi keys. Exclude ambiguous symbols removes brackets, the slash, the tilde and , ; : ., which some forms, shells and configuration files handle badly, leaving ! @ # $ % ^ & * - _ = + ?. Both shrink the pool, so add a character or two to compensate.
Frequently asked questions
How long should a password be?
At least 15 characters for an account protected only by a password, which is the minimum NIST SP 800-63B-4 sets for single-factor passwords. With a password manager, 16 to 24 random characters cost you nothing. For passwords you type often, consider a passphrase of five or six random words.
Is it safe to use a password generated on a website?
crypto.getRandomValues(), and passwords are not transmitted, logged or saved. Copy the one you need straight into your password manager.What does the entropy in bits mean?
It is the base-2 logarithm of the number of passwords your settings can produce. 80 bits means 2 to the power of 80 possible passwords, and each extra bit doubles the work of guessing. It describes how the password was generated, so it only applies to random passwords.
Should I change my passwords regularly?
Not on a fixed schedule. NIST SP 800-63B-4 tells services not to force periodic changes, because people respond with predictable variations. Change a password when a service reports a breach, when it appears in a leak, or when you suspect someone else knows it.
Does requiring every character type make a password stronger?
No. The option, on by default, only makes sure that sites with composition rules accept the password. The tool discards and regenerates passwords that miss a selected type, which rules out some combinations and lowers the real entropy slightly, most noticeably for short passwords, so the figure shown is an upper bound. Adding length is the better way to gain strength.