Password Generator
Generate strong random passwords in your browser from a secure random source. Pick length and character types; see entropy and time to guess.
This generator builds passwords with your browser's cryptographic random number generator (crypto.getRandomValues), so nothing travels over the network. It also shows the entropy in bits and how long a brute-force attacker would need, on average, at the speed you choose.
How to use this tool
- Set the length — 16 or more characters is a sensible default when a password manager stores it for you.
- Tick the character types to use, and trim the symbol list if a site rejects some symbols.
- Optionally exclude look-alikes (O 0 I l 1 |) for passwords you will type by hand.
- Choose how many passwords to make and an attacker speed.
- Press Calculate for a fresh set.
Formula
Entropy = L × log₂(N) + log₂(P) · average guessing time = 2^(Entropy − 1) ÷ guesses per second
L is the length and N the number of distinct characters in the pool (26 + 26 + 10 + 32 = 94 with every type ticked). P is the share of strings that contain every required type (inclusion–exclusion); it is 1 when "at least one of each" is off. Strings missing a type are redrawn, so every allowed password is equally likely and the entropy is exact.
Example
With all four types and the 32 default symbols the pool holds 94 characters. A 16-character password without the "one of each" rule has 16 × log₂(94) ≈ 104.9 bits. At 10 billion guesses per second an attacker needs on average 2^103.9 ÷ 10^10 seconds, about 58.9 trillion years. Requiring one of each type trims the entropy only to about 104.6 bits.
Frequently asked questions
Is it safe to make a password on a web page?
Here it is created by your browser with crypto.getRandomValues, a cryptographically secure source. The page does not send or store it and works offline once loaded.
How long should a password be?
NIST SP 800-63B (2025 revision) requires at least 15 characters when a password is the only sign-in factor, at least 8 when it is combined with another factor, and asks sites to accept at least 64. With a password manager, 16–20 random characters cost nothing extra.
Do symbols matter more than length?
Length wins. Each extra character from the 94-character pool adds about 6.6 bits, while switching symbols on for a 16-character password only lifts it from about 95.3 bits (62 characters) to 104.9 bits. Use symbols when allowed, but never shorten the password for them.
What does the time estimate assume?
An offline attacker trying every possible password at a constant speed and finding yours halfway through on average. Slow hashes such as bcrypt or Argon2 cut that speed sharply, but no entropy protects a password that is reused or leaked.
Sources
Last updated: 2026-10-30