How to use the password generator
- Choose random characters or a passphrase made of words.
- For characters, set the length and tick the character types to include: uppercase, lowercase, digits and symbols.
- Optionally leave out look-alike characters such as I, l and 1, or the symbols some systems reject, such as quotes and brackets.
- Keep at least one of each chosen type ticked if a site insists on a mix.
- For a passphrase, set the number of words, the separator, and whether to capitalize words or add a digit.
- Choose how many to generate, then copy the one you like. The button makes a fresh set.
Nothing you generate is stored or sent anywhere. The page builds each password with your browser's own secure random generator, and it's gone when you leave.
How password strength is measured
Strength is measured in bits of entropy: the base-2 logarithm of how many different passwords the same settings could have produced. Each extra bit doubles the guesses an attacker needs.
The word list has 2,111 common English words, so each word adds 11.04 bits. When you require one of each type, the calculator subtracts the passwords that would have lacked a type, using inclusion-exclusion, so the figure stays exact.
Each character or word is picked with crypto.getRandomValues and rejection sampling. A random 32-bit number is thrown away if it falls above the last whole multiple of the pool size, so every character is exactly as likely as every other. The common shortcut of taking the remainder without that check slightly favors some characters.
Worked example
The defaults are 16 characters with all four types and at least one of each:
- Pool: 26 uppercase + 26 lowercase + 10 digits + 32 symbols = 94 characters
- Bits per character: log2(94) = 6.555
- 16 characters: 16 × 6.555 = 104.87 bits
- Requiring every type keeps 82.3% of all 16-character strings, which costs log2(0.823) = 0.28 bits
- Entropy: 104.6 bits, rated Very strong
At 100 billion guesses a second, finding it would take about 4.8 trillion years on average. The default passphrase of 6 words has 6 × 11.04 = 66.3 bits, rated Good. A seventh word takes it to 77.3 bits, which rates as Strong.
Strength ratings
| Entropy | Rating | Average time to guess at 100 billion tries a second |
|---|---|---|
| Under 45 bits | Very weak | Under 3 minutes |
| 45 to 59 bits | Weak | Up to about a month |
| 60 to 74 bits | Good | 67 days to about 3,000 years |
| 75 to 99 bits | Strong | 6,000 years to about 100 billion years |
| 100 bits or more | Very strong | Over 200 billion years |
The guessing speed is a worst case: an offline attack with fast hardware against a poorly protected password file. Logging in through a website is millions of times slower. For comparison, 8 random characters of all types give 51.3 bits, 12 give 78.1 bits and 16 digits give only 53.2 bits.
Tips for using generated passwords
Use a different password for every account, so one breach doesn't unlock the others. A password manager can store them all behind one long passphrase. NIST's SP 800-63B-4 tells sites to require at least 15 characters when a password is the only login factor, and not to force symbol rules or regular changes. Turn on two-factor authentication wherever it's offered.
Frequently asked questions
Is it safe to generate a password on a website?
This one never sends or saves anything: the passwords are made in your browser with its built-in cryptographic random generator, and no copy leaves your device. You can even load the page, disconnect from the internet and keep generating. Clear your clipboard after pasting a password somewhere.
Which is better, a random password or a passphrase?
Both are strong when long enough. Random characters pack more entropy into each character, so they suit a password manager. Passphrases are easier to type and remember, so they suit a master password or a device login. Use at least 7 words to reach the Strong rating.
How long should my password be?
For random characters with all four types, 16 or more gives over 100 bits. If a site only allows letters and digits, use 18 or more to stay above 100 bits. Longer is always better as long as the site accepts it.
Why leave out look-alike characters?
Characters such as I, l, 1 and | or O, 0 and o are easy to mix up when you type a password from paper or read it aloud. Leaving them out removes a few characters from the pool, which costs a little entropy per character. Add a character or two to make up for it.
Related calculators
- Base64 Encode and Decode — Encode text to Base64 or decode Base64 back to text, with full UTF-8 support and the URL-safe variant.
- URL Encode and Decode — Percent-encode text or whole URLs, decode them back, and see any URL split into its parts and query parameters.
- Random Number Generator — Pick random whole numbers or decimals in any range, one or thousands at a time, with or without repeats.
Results are calculated in your browser. Double-check anything important before you rely on it. See our disclaimer.