Password Generator guide
Generate strong, random passwords with your browser's cryptographic random number generator. Choose the length and character sets, see the entropy in bits, and copy the result. Nothing leaves your device.
How the passwords are generated
Each character is picked with crypto.getRandomValues, the browser's cryptographically secure random number generator. It is the same source browsers use for encryption keys. Math.random, which many simple generators use, is not designed for security and should never be used for passwords.
The character sets leave out look-alikes such as capital I, capital O, lowercase l, 0, and 1, so a password is readable if you ever have to type it from another screen. With all four sets on, the pool is 69 characters.
What makes a password strong: entropy
Strength is measured in bits of entropy: length × log2(pool size). With 69 possible characters, each one adds about 6.1 bits. A 12-character password has roughly 73 bits; 18 characters gives about 110 bits.
Put that in real terms. An offline attacker with a fast GPU rig might try 10 billion guesses per second against a weak hash. At 73 bits, the average time to crack is about 15,000 years. At 110 bits, it is longer than the age of the universe by an absurd margin. Every character you add multiplies the work by 69.
Length beats complexity. A 16-character lowercase-only password (about 75 bits) is stronger than a 10-character password with every symbol type (about 61 bits).
Recommended lengths
NIST guidelines emphasize length over forced complexity and recommend allowing at least 64 characters. Practical targets: 16 or more characters for anything stored in a password manager, 20 or more for your email and password manager master accounts, and the maximum a site allows for financial accounts.
If a site rejects symbols, turn them off and add four characters to compensate.
Random strings versus passphrases
Random strings are best for anything a password manager fills in for you. For the few passwords you must memorize, such as your manager's master password or your computer login, a passphrase is easier. Four random words from a 7,776-word diceware list give about 52 bits; six words give about 78 bits, which is plenty. The words must be chosen randomly, not by you.
Why human-chosen passwords fail
People are predictable. Leaked password lists show the same patterns every year: a word, a capital first letter, a number at the end, and an exclamation point. "Summer2026!" technically has uppercase, lowercase, digits, and a symbol, but cracking tools try exactly that pattern early. Substitutions like @ for a and 0 for o are built into every cracking dictionary.
Randomness is the fix. A generated password has no pattern to guess, so an attacker is left with brute force, and brute force against 16 or more random characters is not realistic with any hardware that exists today.
Handling site restrictions
Some sites still cap passwords at 12 or 16 characters or ban certain symbols. Generate at the maximum length they allow and turn off any character set they reject. If a site limits you to something weak, like 8 characters, make sure that account has two-factor authentication and a unique password, so a breach there cannot spread.
If a site forces periodic password changes, generate a fresh password each time rather than incrementing a number. Current NIST guidance actually recommends against forced rotation unless there is evidence of compromise.
What actually gets accounts hacked
Most breaches do not involve brute force. They involve reused passwords leaked from another site, phishing pages, and missing two-factor authentication. So: use a unique password for every account, store them in a reputable password manager, and turn on two-factor authentication, preferably an authenticator app or passkey rather than SMS.
Generated passwords here never leave your device. There is no server, no log, and no history. Copy the result straight into your password manager and close the tab.
How we calculate: sources
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created on your device with crypto.getRandomValues, the same secure random source browsers use for encryption keys. Nothing is sent to a server or stored.
What is a strong password?
One that is long, random, and unique to one account. Aim for at least 75 bits of entropy, which is about 13 characters from this generator's full character set, or 16+ characters to be comfortable.
How long would it take to crack a 12-character password?
A random 12-character password from a 69-character pool has about 73 bits of entropy. At 10 billion guesses per second, the average crack time is on the order of 15,000 years. Human-chosen 12-character passwords fall far faster because they follow patterns.
Why are some letters and numbers missing?
Look-alike characters such as capital I, capital O, lowercase l, 0, and 1 are excluded so you can read and type the password without mistakes. The pool is still 69 characters with all sets on.
Does every password include each character type?
Yes. If you select uppercase, lowercase, numbers, and symbols, each generated password contains at least one of each, so it passes typical site complexity rules.
Should I change my passwords regularly?
Not on a schedule. NIST SP 800-63B says not to force periodic changes. Change a password when a service is breached or you suspect it has been exposed.
Are generated passwords sent anywhere?
Everything runs in your browser. Nothing you enter is uploaded to a server or stored by us.
How long should a password be in 2026?
At least 16 characters for most accounts and 20 or more for critical ones like email and your password manager. Length matters more than symbols.
Is a passphrase safer than a random password?
A six-word random passphrase is about as strong as a 13-character random password and much easier to remember. Use passphrases for passwords you must type from memory.