Password Generator

A 16-character password from this generator carries about 103 bits of entropy

Entropy measures how many guesses an attacker would need, in powers of two. For a password whose characters are drawn at random, it is the length times log2 of the number of possible characters. Lowercase, uppercase, digits and the 25 symbols here make 87 possible characters, worth log2(87) = 6.44 bits each, so 16 characters carry 16 × 6.44 = 103.1 bits: about 2^103 possible passwords.

Requiring at least one of each character type removes a tiny share of those combinations, so the true figure is a fraction of a bit lower. Leaving out the six look-alike characters (I, l, 1, O, 0, o) cuts the alphabet to 81, about 101 bits at the same length — a small price for a password you might read aloud or type from paper.

Length beats complexity: what NIST’s password guidance now says

The US National Institute of Standards and Technology’s digital identity guidelines, SP 800-63B Revision 4, finalised in 2025, ask for passwords of at least 15 characters when a password is the only authenticator and at least 8 when it is one factor of several. They tell services not to impose composition rules such as "one symbol and one number", not to force periodic changes without evidence of compromise, to allow at least 64 characters, and to let people paste — so password managers work.

The reason is that a long random password is strong because of its length, while rules and forced rotation push people towards predictable patterns like Summer2026!. This generator follows the same idea: pick a long length, and use symbols only where the site accepts them.

Eight letters and digits fall in about three hours; sixteen characters outlast the universe

The brute-force figure assumes an offline attack on a stolen, fast, unsalted hash at 10 billion guesses a second — a well-equipped attacker — and counts the average, half of all possibilities. An 8-character password of letters and digits (62 characters, 47.6 bits) falls in about 3 hours; 10 such characters take about 486 days; 12 take about 5,100 years. The default 16 characters from 87 would take far longer than the age of the universe.

Real sites that store passwords properly use slow, salted hashes and lock out repeated online guesses, which makes attacks much slower still. The bigger everyday risks are reusing a password that leaks from another site and being tricked into typing it on a fake page, which is why a unique password for every account matters more than a few extra characters.

Why this page never sees your password

The server sends the page without any password in it. Each password is created afterwards in your browser, using crypto.getRandomValues — the operating system’s cryptographically secure random source — and every character is chosen by rejection sampling so none is more likely than another. Nothing is transmitted, logged or stored, and a new password is made each time you change a setting or press Generate new.

Paste it straight into a password manager rather than keeping it in a document or an email, and turn on two-factor authentication wherever it is offered.

Six random words give about 77.5 bits — easier to type, weaker than 16 random characters

A passphrase strings together words chosen at random from a list. With the widely used 7,776-word list (the Diceware approach, where five dice pick each word), every word adds log2(7,776) = 12.9 bits, so six words carry about 77.5 bits and seven about 90.5. That is strong enough for most accounts and far easier to type on a phone or remember for the one password you cannot store — your password manager’s master password.

The words must be picked at random, not chosen: a quote, lyric or phrase you like is far easier to guess than its length suggests. For everything your password manager fills in for you, a long string of random characters, like the ones generated here, is stronger for its length and costs you nothing to use.

Worked example

The default: 16 characters from lowercase, uppercase, numbers and 25 symbols.

Limitations

• Entropy measures a random password; it says nothing about one you chose yourself.
• Brute-force times assume 10 billion guesses a second against a fast, unsalted hash.

Frequently Asked Questions

Sources & References

Figures on this page are checked against primary, authoritative sources. Links open in a new tab.

• NIST SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator ManagementNational Institute of Standards and Technology (NIST) · verified 2026-09-22
• Use Strong PasswordsCybersecurity and Infrastructure Security Agency (CISA) · verified 2026-09-22
• Crypto: getRandomValues() methodMDN Web Docs · verified 2026-09-22

Related Calculators

More in Everyday, or browse all calculators.