Secure Password Generator
Create truly random passwords with the length and characters you choose. They are generated on your device and are never sent or stored.
Educational use: results are estimates made for study and reference. Checking the answer and deciding what to do with it is the sole responsibility of whoever uses the tool. Read the legal notice.
On this page
- How to generate your password
- How we measure strength: entropy
- Length and strength, side by side
- What a strong password cannot do on its own
- Comparing ways to create passwords
- Every extra character counts a lot
- Habits that weaken any password
- Questions about passwords
- What to use a generator for
- A brief history of passwords
- Security fun facts
- Security vocabulary
- More utilities
How to generate your password
- Choose the length. For important accounts (email, bank, password manager), go for 16 characters or more.
- Check the character types the site accepts. If a site forbids symbols, uncheck that option. If it accepts them, leave it checked, since more types mean more combinations.
- Click Generate password. The tool shows the password, its length, the size of the alphabet used, the approximate entropy in bits and a strength rating.
- Copy it and store it safely. The best place is a password manager. Do not jot it down in loose files or send it in a message.
The "Avoid look-alike characters" option is useful when the password has to be typed by hand, for example on a TV or a Wi-Fi network: it removes the zero and the letter O, the one and the letters I and l from the list.
How we measure strength: entropy
The strength of a randomly generated password is measured in bits of entropy: how many times an attacker would have to double their effort to be sure of getting it right. The calculation is simple:
With the full alphabet (26 lowercase + 26 uppercase + 10 numbers + 32 symbols, around 94), each character is worth about 6.55 bits. A 16-character password has around 105 bits, something like 2¹⁰⁵ possibilities: a number with more than 30 digits.
The role of randomness
This calculation only holds if the choice of characters is truly random. Passwords made up by humans, even with letters, numbers and symbols, follow patterns (starting with a capital letter, ending with a number or an exclamation mark, swapping "a" for "@"). That is why a password like "Tr0ub4dor&3" looks strong but has far less real entropy than one of similar length generated at random.
How this tool draws characters
It uses the browser's cryptographic generator (crypto.getRandomValues), the same kind of randomness source used by security applications, instead of ordinary "random number" functions, which are predictable. To avoid bias, the draws use a method that guarantees every character has exactly the same chance.
Length and strength, side by side
Approximate entropy in bits, for fully random passwords:
| Length | Lowercase only (26) | Letters and numbers (62) | Everything, with symbols (94) |
|---|---|---|---|
| 8 characters | 37.6 | 47.6 | 52.4 |
| 12 characters | 56.4 | 71.5 | 78.7 |
| 16 characters | 75.2 | 95.3 | 104.9 |
| 20 characters | 94.0 | 119.1 | 131.1 |
| Entropy | Rating used here |
|---|---|
| less than 40 bits | weak |
| 40 to 59 bits | fair |
| 60 to 79 bits | strong |
| 80 to 99 bits | very strong |
| 100 bits or more | extremely strong |
Notice the effect of length: going from 8 to 16 characters, with the same alphabet, doubles the bits, and that means squaring the number of possibilities. Increasing the length is worth far more than swapping letters for symbols.
What a strong password cannot do on its own
This tool generates passwords with good randomness, but an account's security depends on much more than the password: how it is stored, whether it is unique to each service, whether the site protects it properly, whether two-step verification is on and whether you avoid falling for phishing scams. The strength rating is a theoretical entropy estimate, not a guarantee of security.
Passwords are generated in your browser and are not sent to or stored by us. Even so, be careful about your surroundings: people looking over your shoulder, suspicious browser extensions and the clipboard, which may keep the copied text, can expose the password. Some sites limit the length or the types of characters, so adjust the options to the service's rules. Using the generated passwords is the user's responsibility.
Bottom line: this tool is educational. Results do not replace your own checking, and how you use them is entirely your responsibility. More details in the legal notice.
Comparing ways to create passwords
1. A common word with a number
password123
It is on every leaked-password list and is tried right at the start of an attack. Very low effective entropy, even at 11 characters.
2. The "clever password" with swaps
P@ssw0rd!
Swapping letters for look-alike symbols is the first trick attackers try. This password appears on well-known lists and gives a false sense of security.
3. Random, 16 characters
Something like k7#Qm2vX!r9LpT4w (just an example of what it looks like).
There is no pattern to exploit. Each position is drawn independently.
4. Passphrase of randomly drawn words
Four to six common words drawn at random from a large list (for example, 7,776 words, as in the Diceware method).
Passphrases are easier to remember and type, and work well for what you need to memorize (such as a password manager's master password). The key is that the words are truly drawn at random, not chosen by you.
Every extra character counts a lot
Strength grows linearly in bits, but the effort needed to guess grows exponentially. Here is the entropy with the full alphabet:
Habits that weaken any password
Reusing the same password
It is the biggest everyday risk. When one site leaks, attackers try the same email and password combination on dozens of other services. A unique password for each account limits the damage.
Using personal information
Name, date of birth, nickname, favorite team and pet's name are the first place someone looks, and they are often on social media.
Swapping letters for look-alike symbols
"a" for "@," "o" for "0" and "s" for "$" are well-known tricks and easy to test. Length and randomness are worth more than disguises.
Storing it somewhere unsafe
Unprotected spreadsheets, notes on a phone with no passcode, emails to yourself and sticky notes on the screen are all risks. A trustworthy password manager solves the problem of storing and filling in passwords.
Sharing it by message
Passwords sent by chat or email stay in the history. If you must share one, use the sharing features built into a password manager.
Not turning on two-step verification
Even a great password can leak or be stolen by a scam. Two-step verification, preferably through an app or a security key, protects you even if the password is discovered.
Questions about passwords
Are these passwords really random?
Yes. We use the browser's cryptographic generator (crypto.getRandomValues), not ordinary random-number functions, which are predictable. The draw is done so that every character has the same chance.
Do you store or send the passwords I generate?
No. Everything happens on your device. Nothing is sent to a server, database or history. When you close or refresh the page, the passwords are gone.
What is the ideal length for a password?
For most accounts, 16 random characters with mixed types is an excellent choice. For very important accounts or master passwords, 20 or more, or a long passphrase.
Do I really need symbols?
They help, because they enlarge the alphabet, but length matters more. A random password of 20 letters and numbers (119 bits) is stronger than one of 10 characters with symbols (about 66 bits).
What is password entropy?
It is a measure, in bits, of how many possibilities exist. Each extra bit doubles the work for anyone trying to guess. Formula: length × log₂(alphabet size).
How will I remember so many different passwords?
Use a password manager and memorize just one strong master password, preferably a long phrase. The manager fills in the rest.
What should I do if a site does not accept long passwords or symbols?
Adjust the generator's options to what the site allows, increasing the length up to the accepted limit. And consider whether the service is trustworthy, since very low limits are a sign of outdated security practices.
Should I change my passwords from time to time?
There is no need to change them for no reason, if the password is strong and unique. Change it when you suspect a leak, when the service sends a notice or when someone unauthorized has had access.
What does "avoid look-alike characters" mean?
It removes the zero and the letter O, the number one and the letters I and l from the list, which are easy to confuse when the password is read or typed by hand.
Can I use a password generated on another site for the same account?
You can, but the ideal is to generate a new one for each account. Reusing passwords across services is one of the biggest security risks.
What to use a generator for
- New accounts: every service gets a unique password, with no memorizing effort.
- Replacing weak or old passwords after a data breach or a security notice.
- Wi-Fi and routers: strong passwords for home and guest networks.
- Vaults and password managers: the master password or recovery keys.
- Test keys and tokens: random strings for development projects and test environments.
- Learning: seeing in practice how length and alphabet change a password's strength.
A brief history of passwords
The first computer passwords appeared in the 1960s, in MIT's time-sharing systems, where several people used the same machine and needed a way to keep each person's files separate. Before long, the invention showed its first problems: passwords stored in text files and discovered by curious users.
For decades, the advice was to use passwords with letters, numbers and symbols and change them often. In 2017, the United States' standards institute (NIST) changed its guidance: prioritize long passwords, stop requiring periodic changes for no reason and check chosen passwords against lists of leaked ones. The change reflected what practice had shown: complicated rules lead people to create predictable patterns.
Security fun facts
- The most used passwords in the world, year after year, are still sequences like "123456" and "password." Anyone who uses them can be broken into in seconds.
- Diceware, a method of creating passphrases by rolling dice to draw words from a list, was proposed in 1995 by Arnold Reinhold.
- A famous comic strip, published in 2011, popularized the idea that four random words are easier to remember and harder to guess than a "complicated password" of eight characters.
- Each extra character multiplies an attacker's work by the size of the alphabet. Adding a single character to a password drawn from 94 symbols makes the search 94 times more work.
Security vocabulary
- Entropy
- A measure of a password's unpredictability, in bits. More bits mean more guesses needed.
- Alphabet
- The set of characters possible at each position in the password.
- Brute-force attack
- A systematic attempt at every possible combination until one works.
- Password manager
- A program that stores your passwords in protected form and fills in forms for you.
- Two-step verification (2FA)
- A second login step (a code, an app or a physical key) in addition to the password.
- Phishing
- A scam that imitates a legitimate site or message to steal passwords and data.
- Passphrase
- A long password made of several words, easier to remember.