Free password generator
Generate a strong, random password from a length and the character sets you choose — lowercase, uppercase, digits and symbols — drawn with your browser's cryptographically secure RNG, with the entropy in bits shown so you can see how strong it is, updated live, as you type.
On this page15 sections
Output is generated client-side in your browser. No data is transmitted to any server.
Results are estimates. Consult a professional.
What this password generator does
This password generator builds a strong, random password for you. Pick a length, tick the character sets you want — lowercase, uppercase, digits and symbols — and the tool assembles a password by drawing each character at random from that pool. It also reports the password's entropy in bits, the single number that tells you how hard the result is to guess.
The point is to defeat the way humans pick passwords. Left to ourselves we reuse a favourite, swap a letter for a digit, or tack a year on the end — patterns an attacker's software tries first. A generated password has no pattern: every character is an independent draw, so the only way to crack it is to guess the whole keyspace. The result updates the moment you change a setting, and a Regenerate button gives you a fresh one.
How the generator picks each character (CSPRNG, not Math.random)
Randomness is the whole game, and not all randomness is equal. This tool uses the browser's cryptographically secure random number generator, crypto.getRandomValues() from the Web Crypto API. It deliberately does not use Math.random(), which is fast but predictable: its output can be reverse-engineered from a handful of samples, so a password built on it can be reconstructed.
- Build the pool — the character sets you ticked are concatenated into one alphabet. With lowercase, uppercase, digits and symbols all on, that pool is 88 characters wide.
- Draw securely — for a password of length L, the tool asks
crypto.getRandomValues()for L cryptographically random numbers. - Map to characters — each random number is reduced modulo the pool size to index one character. Concatenate them and you have the password.
Password entropy: what the bits number means
Entropy is a measure of how many equally likely passwords your settings could have produced, expressed in bits. Each extra bit doubles the number of possibilities. It is the honest way to talk about strength, because it ignores how a password looks and counts only how many guesses an attacker would need.
A rough rule of thumb: under ~50 bits is weak, ~60–70 bits is a reasonable everyday floor, and roughly 80 bits or more is strong — comfortably beyond the reach of an offline brute-force attack with today's hardware. The 100-plus bits the default 16-character setting produces is overkill for almost any account, in the good sense.
Entropy and crack-time by length and character set
This table shows the entropy (bits) for common lengths and character sets, and a rough offline crack time assuming a fast attacker making one trillion (10¹²) guesses per second against an unsalted, fast hash — a deliberately pessimistic, attacker-favourable assumption. The pattern is the headline: length moves the needle far more than adding one more character class.
| Length | lower only (N=26) | + digits (N=36) | + upper (N=62) | all 4 sets (N=88) | Crack time (all 4) |
|---|---|---|---|---|---|
| 8 | 38 bits | 41 bits | 48 bits | 52 bits | ~38 minutes |
| 12 | 56 bits | 62 bits | 71 bits | 78 bits | ~3,800 years |
| 16 | 75 bits | 83 bits | 95 bits | 103 bits | ~10¹¹ years |
| 20 | 94 bits | 103 bits | 119 bits | 129 bits | ~10¹⁶ years |
| 24 | 113 bits | 124 bits | 143 bits | 155 bits | heat death of universe |
Entropy = length × log₂(pool size). Crack times assume 10¹² guesses/second against the full keyspace (average ≈ half) — far faster than online attacks, which are throttled. The takeaway: an 8-character password is weak even with every character set; a 16-character one is strong with any of them.
Length vs complexity: why a longer password beats a complex one
The single most useful thing to understand about passwords is that length wins. In the formula H = L × log₂(N), length L multiplies, while adding a character class only nudges N inside a logarithm. Going from 12 to 16 characters adds far more entropy than going from "letters and digits" to "letters, digits and symbols" at the same length.
Read the table above across a row, then down a column. Moving from a pool of 26 to 88 at length 12 takes you from 56 to 78 bits — a useful jump. But simply growing a lowercase-only password from 12 to 16 characters takes you from 56 to 75 bits for free, no new character types required. Four more characters beat three more character classes.
How to use the password generator
- Set the length. 16 is a sensible default; 12 is the everyday floor, and 20+ suits high-value accounts. Longer is stronger — see the section above.
- Choose character sets. Leave lowercase, uppercase, digits and symbols all on for the widest pool. Turn symbols off only if a site rejects them.
- Exclude ambiguous characters (optional). Ticking this drops look-alikes (0, O, o, I, l, 1) so a password is easier to read and retype by hand — handy for Wi-Fi keys read aloud.
- Copy the result. The generated password and its entropy in bits appear instantly. Hit Regenerate for a different one, then paste it straight into your password manager.
With the default settings — length 16, all four sets on — the pool is 88 characters wide, so each character carries log₂(88) ≈ 6.46 bits. Sixteen of them give ≈ 103 bits of entropy, which the tool rounds and labels "strong". A sample output looks like k7$Rp2!vQ9mLx#Tb — no word, no pattern, nothing an attacker's dictionary can shortcut.
Password best practices: unique, stored, never reused
Generating a strong password is only half the job. How you store and reuse passwords matters just as much, because the most common way accounts fall is not brute force — it is reuse. When one site is breached, attackers replay the leaked password against every other service ("credential stuffing"). A unique password per site contains the damage to one account.
- Use a unique password for every site. Reuse is the single biggest risk; a generated password is wasted if it guards ten accounts.
- Store them in a password manager. You are not meant to remember 16 random characters — a manager generates, stores and autofills them, so the only password you memorise is the vault's.
- Make the length count. 12+ characters for ordinary accounts, 20+ for email, banking and anything that can reset other accounts.
- Turn on two-factor authentication. Even a strong password benefits from a second factor; it stops an attacker who somehow obtains the password alone.
- Never share or email a password in plain text. If you must transmit one, use the service's sharing feature or a one-time secret link.
Why NIST dropped forced complexity and password rotation
For years the rules were "use an uppercase letter, a digit and a symbol, and change your password every 90 days." Modern guidance from NIST SP 800-63B reverses both. The composition rules pushed people toward predictable patterns (Password1!, Password2!), and forced rotation made them choose weaker, more guessable passwords they could remember through the churn.
- No mandatory composition rules. NIST advises against requiring specific character types; length and a breach check do more for security than forced symbols.
- No periodic forced rotation. Passwords should change only when there is evidence of compromise, not on a calendar — routine expiry encourages weak, incremented choices.
- Screen against breached passwords. The real win is blocking passwords already known to be leaked, which a generated random string never is.
- Allow length and all characters. Support long passphrases and accept spaces and symbols rather than capping length or banning characters.
Generating a password is not the same as storing one (hashing)
This tool generates passwords for you to use. A different problem — one for developers — is how a site should store the passwords its users choose. The two are easy to confuse, but the techniques are opposites: generation is about producing unpredictable secrets, while storage is about keeping a secret you have been given without ever holding it in readable form.
A site must never store passwords as plain text, and should not store a fast hash of them either. The correct approach is a slow, salted password-hashing function such as bcrypt, scrypt or Argon2. These are deliberately expensive to compute, which cripples an attacker trying billions of guesses against a stolen database. A general-purpose hash like SHA-256 is fast — great for integrity checks, wrong for passwords. See our hash generator for the difference between hash families.
Is this password generator safe to use?
Yes. Every password is generated locally in your browser using the Web Crypto API. Nothing is sent to a server, logged, or stored — there is no network request, because the randomness comes from your own device. Close the tab and the password is gone unless you saved it. The page works the same offline.
Because generation is client-side, the result is yours alone — no one operating this site ever sees it. Pair the generator with a password manager (which also runs locally or end-to-end encrypted) and you get a strong, unique secret per account without anyone in the middle. For other identifiers, see the UUID generator, which produces random IDs the same client-side way.
Password generator definitions
Frequently asked questions about the free password generator
About this password generator
This password generator runs entirely in your browser. Each password is built locally with the Web Crypto API (crypto.getRandomValues) from the length and character sets you choose — nothing is sent to a server, logged, or stored, so the tool works the same offline. It also shows the password's entropy in bits, the honest measure of how hard it is to guess.
Looking for more developer utilities? Browse the rest of our dev tools, or see the full library on the all calculators page.