Password Generator

What Makes a Password Strong?

Password strength mostly comes down to two things: length and unpredictability. A longer password with a mix of uppercase, lowercase, numbers, and symbols is exponentially harder to guess or crack than a short one, even one that looks complex. Aim for at least 12-16 characters with all four character types enabled for anything protecting sensitive accounts. It's worth being clear about why "exponentially" is the right word here and not just a figure of speech, adding one extra character to a password doesn't just add a fixed amount of security, it multiplies the total number of possible combinations by the size of the character pool, which is why length has an outsized effect on how hard a password actually is to guess.

How This Generator Works

This tool uses your browser's built-in cryptographically secure random number generator (crypto.getRandomValues) rather than ordinary random functions, the same category of randomness used for actual security-sensitive purposes, unlike a simple dice-roll or raffle generator. Nothing is sent anywhere; the password is created and shown entirely on your device, and a fresh password is generated instantly every time you adjust the length slider, toggle a character type, or click Generate again.

Using Your New Password Safely

• Use a different password for every account, reusing passwords means one leaked site compromises all of them.
• Store passwords in a reputable password manager rather than a text file or sticky note.
• Enable two-factor authentication wherever it's offered, in addition to a strong password.

What "103 Bits of Entropy" Actually Means

With all four character types enabled, this generator draws from a pool of 88 possible characters (26 uppercase, 26 lowercase, 10 digits, and 26 symbols), which works out to about 6.46 bits of entropy per character, entropy here meaning how many yes/no guesses, on average, it would take to narrow down a single character. At the default length of 16 characters, that compounds to roughly 103 bits of total entropy, corresponding to about 1.3 × 10³¹ possible combinations. To put that number in perspective, that's a far larger figure than the estimated number of grains of sand on Earth, and it's why length matters more than any other single factor: each additional character multiplies the total number of possible passwords by 88, while adding a single extra character type (going from 3 to 4 character categories) only adds a comparatively modest boost to the per-character entropy.

Why This Tool Avoids "Modulo Bias"

Generating a random number within a specific range (like picking one of 88 characters) from raw random bytes is trickier to do correctly than it looks. A naive approach, taking a random byte (0-255) and using the remainder after dividing by the pool size, introduces a subtle bias: since 256 isn't evenly divisible by most pool sizes, some characters end up very slightly more likely to appear than others. This tool avoids that problem using a technique called rejection sampling, it discards any random byte that falls outside the largest range evenly divisible by the pool size, and draws a new one instead, repeating as needed. This is a small technical detail invisible in the output, but it's the difference between a password generator that's truly uniformly random and one with a barely measurable statistical skew, the kind of skew that matters for genuine cryptographic-grade randomness even if it would never be noticeable by eye.

How the Strength Meter Is Calculated

The strength indicator above the Generate button scores a password on two combined factors: its length and how many different character type categories are enabled. Length crosses three thresholds, 8, 12, and 16 characters, each adding a point to the score, while character variety adds a point at 3 enabled types and another at all 4. This produces a simple five-level score that maps to the Weak, Fair, Good, and Strong labels shown, weak passwords are short and use few character types, while a Strong rating requires both meaningful length (16+ characters) and full character variety. This is a simplified heuristic rather than a full cryptographic analysis, but it reflects the two factors that matter most for resisting brute-force guessing, which is exactly what a randomly generated password (as opposed to a memorized, pattern-based one) needs to resist.

Choosing a Length for Different Situations

The right password length depends somewhat on what it's protecting and how it's used. For most everyday website accounts, 16 characters with full character variety, this tool's default, comfortably exceeds any realistic security requirement while remaining easy to paste from a password manager. For a master password you'll need to type by hand occasionally, like a password manager's own unlock password, a longer passphrase-style approach (several random words strung together) is sometimes preferred for its balance of memorability and length, though this generator's approach of a shorter, denser random string works just as well when copy-paste is available. For a system that specifically caps password length, common with some older enterprise systems, use the slider to match whatever the maximum allowed length is, since a password that gets silently truncated on submission can cause confusing login failures later.

Common Password Mistakes

Using predictable substitutions. Swapping letters for similar-looking symbols, like "P@ssw0rd," feels clever but is one of the first patterns automated cracking tools check, it adds far less real security than it appears to.

Reusing a strong password across multiple sites. Even an extremely strong password loses its value the moment it's reused, since a breach at any one of those sites exposes it for use everywhere else that same password was used.

Relying on personal information. Birthdays, pet names, and other personally meaningful details are exactly what a targeted guessing attempt starts with, a truly random password like the ones this tool generates has no such pattern to exploit.

Choosing a length that's convenient rather than genuinely strong. A short password is easier to type, but as the entropy math above shows, each additional character adds far more real protection than most people intuitively expect, defaulting to a longer length costs almost nothing when paired with a password manager's autofill.

Why a Random Password Needs a Password Manager

A genuinely random 16-character password like xQ7$mK2pL9#vN4wR is essentially impossible to memorize, which is exactly the point, a password that's hard to guess is also hard to remember, and trying to memorize many such passwords for different accounts isn't realistic. A password manager solves this by storing every generated password securely behind a single master password (or biometric unlock), auto-filling the correct one for each site. This turns strong, unique passwords for every account from a memorization burden into a one-time setup step, which is why security professionals near-universally recommend pairing a tool like this generator with a password manager rather than trying to remember randomly generated passwords directly.

Frequently Asked Questions

Is it safe to generate a password on a website?

Yes, in this case, the password is generated entirely by JavaScript running in your browser and is never transmitted over the network. Still, it's good practice to close the tab after copying your password and to avoid generating passwords on unfamiliar or untrusted sites in general.

Why does unchecking all character types not work?

At least one character type needs to stay selected so there's something to build a password from, the tool will keep the last one checked automatically.

How much entropy does a 16-character password with all options have?

With all four character types enabled, the character pool is 88 characters, giving about 6.46 bits of entropy per character. A 16-character password from that pool has roughly 103 bits of entropy total, an astronomically large number of possible combinations, well beyond what any realistic brute-force attack could exhaust.

Why does this use crypto.getRandomValues instead of Math.random?

Math.random() is a fast, general-purpose random function not designed to be unpredictable in a security sense, some JavaScript engines' implementations can theoretically be predicted or reverse-engineered from prior outputs. crypto.getRandomValues() draws from the operating system's cryptographically secure random number source, the same category of randomness used to generate encryption keys, which is the appropriate choice for anything security-sensitive like a password.

Should I change my passwords periodically even if they're strong?

Current security guidance (including NIST's) has moved away from forced periodic password changes for accounts that aren't known to be compromised, frequent forced rotation tends to push people toward weaker, more predictable passwords. Change a password immediately if a service you use reports a breach, otherwise a strong, unique, randomly generated password doesn't need to be rotated on a fixed schedule.

What if a site limits password length or disallows certain symbols?

Generate a password using the length and character types that specific site actually allows, uncheck symbols if a site rejects them, or lower the length slider if a site caps password length. A shorter or less varied password is still far better than a weak, memorable one, as long as it's still randomly generated and unique to that account.