Password Generator
Create a strong random password or passphrase: generated in your browser, never sent anywhere.
Your password
• • • • • • • • • • • •
Generated in your browser with its own cryptographic random generator. Nothing is saved, stored, logged or sent anywhere, and every value is drawn fresh. It is never a copy of one handed to somebody else. Close the tab and it is gone.
Settings
Quick lengths
This generates random passwords of any length, with your choice of character types.
Generation happens entirely in your browser; nothing is sent anywhere or stored.
What makes a password strong
Password strength is measured in bits of entropy: how many guesses an attacker would need. The formula is length × log₂(character set size).
That formula has a consequence most advice gets backwards. Length beats complexity. Twelve characters from the full 94-character keyboard set gives 78.7 bits. Sixteen characters using only lowercase letters gives 75.2 bits — almost the same, from a far simpler alphabet.
Which is why the modern guidance, including NIST's, has moved away from forced complexity rules. A long passphrase of random words is both stronger and easier to remember than a short string of substituted characters. Six random words from a standard 7,776-word list gives 77.5 bits, matching a 12-character random password.
Length contributes linearly; character set only logarithmically. That is why adding characters helps far more than adding symbol types.
What to enter
- Length
- The most important input. 16 or more is a reasonable modern default for anything that matters.
- Character types
- Lowercase, uppercase, digits and symbols. Each type added expands the alphabet, though less than length does.
- Exclude ambiguous characters
- Removes l, 1, I, O and 0, which helps if the password will ever be read aloud or typed from a screen.
Entropy by character set
- Lowercase only (26)
- 4.7 bits per character.
- Lower + upper (52)
- 5.7 bits per character.
- Alphanumeric (62)
- 5.95 bits per character.
- Full keyboard (94)
- 6.55 bits per character.
- Diceware word list (7,776)
- 12.9 bits per word, which is why six words is strong.
What this assumes
Entropy assumes the password is genuinely random. A password you invented is far weaker than its length suggests, because human choices are predictable.
This measures resistance to guessing. It says nothing about phishing, keyloggers or a breach at the service itself, which is what unique passwords and two-factor authentication address.
How to calculate password strength
Entropy is the number of possible passwords, expressed as a power of two.
- length
- Number of characters. Contributes linearly, so it dominates
- character set
- How many characters are possible at each position
Choose length first. 16 characters is a sensible modern default. Length is the input that does the most work.
Use a wide character set if the site allows it. The full keyboard set gives 6.55 bits per character against 4.7 for lowercase alone. Useful, but secondary to length.
Generate randomly, never manually. Human-chosen passwords cluster around predictable patterns, and entropy assumes true randomness.
Store it in a password manager. A strong unique password per site is only workable with a manager. Reuse is the risk that actually causes breaches.
See a worked example: why length beats complexity
- Password A
- 12 characters, full keyboard set
- Password B
- 16 characters, lowercase only
A: 12 × log₂(94) = 12 × 6.55 = 78.7 bits.
B: 16 × log₂(26) = 16 × 4.70 = 75.2 bits.
Nearly identical strength, and B uses no symbols, digits or capitals at all.
Six random words gives 77.5 bits, matching both, and is the only one of the three a person could actually remember.
78.7 bits and 75.2 bits — nearly the same
Frequently asked questions
Generation happens entirely in your browser. Nothing is transmitted to a server, logged or stored, and the page works with the network disconnected.
That said, the safest habit for anything important is generating passwords inside your password manager, so the password never appears outside it.
16 characters or more for anything that matters. Twelve is a reasonable minimum; eight is no longer adequate against modern hardware.
Length matters more than symbol variety. Adding four characters helps far more than adding a symbol type.
Yes, if the words are genuinely random and there are enough of them. Six words from a standard 7,776-word list gives 77.5 bits, matching a 12-character random password.
The catch is that the words must be randomly selected, not chosen by you. A memorable phrase you thought of has far less entropy than its length suggests.
Current NIST guidance says no, not on a schedule. Forced periodic changes tend to produce weaker passwords, since people make small predictable edits.
Change a password when there is a reason: a breach notification, a shared password, or any suspicion of compromise.
Very little. Replacing a with @ and o with 0 is a pattern attackers have built into their tools for decades.
"P@ssw0rd!" is barely stronger than "password". Randomness and length are what matter; predictable substitution adds almost no entropy.
Not reusing passwords, and two-factor authentication. Most account compromises come from credential reuse after another site's breach, not from a password being guessed.
A 78-bit password used on twenty sites is worse in practice than twenty distinct weaker ones. Use a password manager and enable 2FA on anything that offers it.
Problems people actually run into
Choosing complexity over length
Complexity rules push people towards short passwords with awkward substitutions, which are hard to remember and not especially strong.
A 16-character lowercase password matches a 12-character mixed one. Add characters rather than symbol types.
Reusing a strong password
Entropy protects against guessing. It does nothing when a site is breached and your password appears in a credential dump.
Attackers try those credentials everywhere. A unique password per site, kept in a manager, is the defence that actually matters.
Results are estimates for general information only and are not professional financial, medical, or legal advice. Read our full disclaimer.
Last updated: September 4, 2026