Password Generator

📋

Walk-through

How to Use This Calculator

4 steps

1

Pick a mode

Choose Generate Password for a random string of characters, or Passphrase for a string of random words that's far easier to remember and type. The result appears instantly and refreshes every time you change an option.

2

Set your rules

For a password, drag the length slider and tick which character sets to include (uppercase, lowercase, digits, symbols). For a passphrase, choose how many words and how they're joined. Use a preset chip to fill a sensible scenario in one click.

3

Check the entropy

Read the entropy in bits and the strength meter. Aim for at least 60 bits for accounts that matter and 100+ bits for the most sensitive. The crack-time table shows how long different attackers would need.

4

Copy and store it

Click Copy and paste the password straight into your password manager — the clipboard auto-clears after about 30 seconds. Never reuse a password across sites, and never email or text it to yourself.

⚡

Reference

Formula & Methodology

4 formulas

Entropy of a random password

H = L × log₂(N)

H is entropy in bits, L is the password length, and N is the size of the character pool (e.g. 26 lowercase + 26 uppercase + 10 digits = 62). Each extra character adds log₂(N) bits; each extra bit doubles the number of guesses an attacker needs.

Entropy with no repeated characters

H = log₂(N) + log₂(N−1) + … + log₂(N−L+1)

When repeats are disallowed, each position draws from a shrinking pool, so the true entropy is the sum of the falling-factorial terms rather than L × log₂(N). It is always slightly lower than allowing repeats.

Entropy of a passphrase

H = W × log₂(D)

W is the number of words and D is the size of the word list. With the EFF long list of 7,776 words, each word adds log₂(7776) ≈ 12.9 bits, so a 5-word passphrase carries about 64 bits before any separators or appended characters.

Estimated crack time

t = 2^(H−1) ÷ G

On average an attacker finds the password after trying half the keyspace, 2^(H−1) guesses. Dividing by the guess rate G (guesses per second) gives the expected time. Fast unsalted hashes allow ~10¹¹ guesses/sec; slow hashes like bcrypt or argon2 cut that by millions.

📖

Glossary

Key Terms Explained

9 terms

Entropy (bits) A measure of how unpredictable a password is. Each bit doubles the number of guesses needed, so 60 bits is roughly a billion times harder to guess than 30 bits. It is the honest way to score password strength.

Character pool The set of characters a password is drawn from. Lowercase letters give a pool of 26; adding uppercase, digits, and symbols grows it to about 94. A bigger pool adds bits per character, but length adds them faster.

Passphrase A password made of several random words (e.g. correct-horse-battery-staple). Each word from a known list contributes fixed entropy, and the result is far easier for a human to remember and type than a random string of equal strength.

Ambiguous characters Characters that are easy to confuse when read or typed: capital I, lowercase l, the digit 1, capital O, the digit 0, and the pipe |. Excluding them makes a password easier to transcribe at a small cost to the pool size.

CSPRNG A cryptographically secure pseudo-random number generator. Browsers expose one as crypto.getRandomValues. Unlike Math.random, its output is unpredictable, which is essential for generating secrets. This tool uses it exclusively.

Brute-force attack Trying every possible combination until one works. Its difficulty is set purely by entropy — the more bits, the more combinations, the longer it takes. Long random passwords defeat brute force outright.

Dictionary attack Guessing from a list of common words, leaked passwords, and predictable patterns rather than every combination. It is why 'P@ssw0rd123' is weak despite meeting complexity rules — it is on every cracking list.

Password manager An encrypted vault that generates, stores, and autofills a unique password for every account. It is the only practical way to use long random passwords everywhere without memorizing them.

Diceware A method of building passphrases by selecting random words from a numbered list using dice. The EFF long word list (7,776 words = 6^5) is a modern Diceware list designed to be memorable and prefix-free.

👥

Scenarios

Real-World Examples

3 worked examples

🔐

An account stored in a password manager

20-character password, all sets

Result

≈ 131 bits — Excellent

Mode Password Length 20 Sets Upper + lower + digits + symbols Entropy ≈ 131 bits

With a pool of about 90 characters and 20 positions, entropy is 20 × log₂(90) ≈ 130 bits. Even an attacker guessing 100 billion times per second would need vastly longer than the age of the universe. This is the right setting for anything you never have to type by hand.

🧠

A master password you must memorize

5-word passphrase

Result

≈ 64 bits — Strong

Mode Passphrase Words 5 Separator Hyphen Entropy ≈ 64 bits

Five EFF words give 5 × 12.9 ≈ 64 bits — strong, and far easier to memorize and type than a 64-bit random string. Add a sixth word (≈77 bits) for a password-manager master password or full-disk encryption, where the stakes are highest.

⚠️

A typical human-chosen password

8 characters, 'Summer1!'

Result

≈ 49 bits — but far weaker in practice

Mode Tester Length 8 Pool ≈ 72 (mixed) Entropy ≈ 49 bits (heuristic)

The raw math says ~49 bits, but a password like 'Summer1!' follows a predictable pattern (capitalized word + year + symbol) that dictionary attacks try first, so its effective strength is much lower. This is exactly why generated randomness beats human-chosen 'complexity'.

📄

Deep Dive

What Actually Makes a Password Strong

4 chapters · 6 min read

Most password advice — mix in a capital, add a number, throw in a symbol — optimizes for the wrong thing. What actually stops an attacker is unpredictability, measured in bits of entropy. This guide explains why length beats complexity, how passphrases give you strength you can remember, and why a generator that runs entirely in your browser is the safest place to make one.

Length beats complexity

Every character you add multiplies the number of possible passwords by the size of the character pool. Going from 8 to 16 characters does far more for security than adding a symbol to an 8-character password. That's because entropy grows linearly with length (each character adds the same number of bits) but only logarithmically with pool size (doubling the pool adds just one bit per character).

Concretely: a 12-character lowercase password has about 56 bits of entropy; an 8-character password using all 94 printable characters has only about 52 bits — and the 8-character one is much harder to type. Complexity rules also backfire by pushing people toward predictable patterns like capital-first, symbol-and-number-last, which attackers exploit. The fix is to stop choosing passwords yourself and let a generator pick truly random ones that are as long as the site allows.

Entropy, explained

Entropy is just a count of how many guesses an attacker would need, expressed as a power of two. A password with 40 bits of entropy can be one of 2⁴⁰ (about a trillion) equally-likely values; 60 bits is about a quintillion. Because each extra bit doubles the work, small increases matter enormously — a 70-bit password is a thousand times stronger than a 60-bit one.

The practical thresholds: under ~40 bits is weak and falls quickly to offline cracking; 60 bits is a reasonable floor for accounts that matter; 80+ bits is strong; and 100+ bits is effectively uncrackable by brute force with any foreseeable hardware. This tool shows the exact figure for whatever you generate so you can aim deliberately rather than guess.

Passphrases versus passwords

A random 16-character password and a 6-word passphrase can carry similar entropy, but only one of them is realistic to memorize and type on a phone keyboard. Passphrases work because each word is drawn at random from a known list — the EFF long list has 7,776 words, so each word is worth about 12.9 bits regardless of how common the word is. The strength comes from the random selection, not from obscurity, so 'correct-horse-battery-staple' is strong precisely because it was chosen randomly.

Use passphrases for the few secrets you must remember: your password-manager master password, your device login, your full-disk-encryption key. Use long random passwords (stored in the manager) for everything else. Capitalizing words or appending a digit and symbol adds a little entropy and helps satisfy sites that still demand 'complexity'.

Why a password manager — and why this runs in your browser

The single most important password habit is never reusing one. The 2012 LinkedIn breach and countless others succeed not by cracking strong passwords but by replaying leaked ones across other sites. A password manager solves this by generating and remembering a unique password per account, so a breach at one site can't cascade. Protect the manager itself with a strong passphrase and turn on two-factor authentication.

This generator is built so you never have to trust a server with a secret. Generation happens entirely in your browser using crypto.getRandomValues, the same cryptographically secure source that powers HTTPS key generation. Nothing is transmitted, logged, or stored — we don't even keep the password in your browser's storage, only your settings. You can confirm this yourself: open your browser's network tab and watch that generating a password makes no requests at all.

❓

Questions

Frequently Asked Questions

8 questions

Are these passwords stored or sent anywhere?+

No — everything happens in your browser. Passwords are generated locally with your device's secure random generator (crypto.getRandomValues) and are never transmitted, logged, or stored on any server. We don't even save them in your browser's storage; only your settings (like length and which sets are on) are remembered, never the generated passwords themselves.

What is entropy and why does it matter more than complexity rules?+

Entropy, measured in bits, is essentially the number of yes/no questions an attacker must answer to guess your password, and each extra bit doubles their work. It captures true randomness far better than 'must contain a symbol' rules, which often push people toward predictable patterns like Password1!. A 20-character random password has roughly 130 bits of entropy; a typical human-chosen password has far less, even if it technically satisfies the complexity checkboxes.

Is a passphrase as strong as a random password?+

Yes, when it has enough words. Each word from the 7,776-word EFF list adds about 12.9 bits of entropy, so a 5-word passphrase carries roughly 64 bits and a 6-word one about 77 bits. Passphrases are far easier to remember and type than a random string of equivalent strength, which makes them ideal for the handful of passwords you must memorize, such as your password manager's master password.

How long should my password be?+

For accounts stored in a password manager, length is free, so use 16–24 characters with as many character sets as the site allows. For something you must type or remember, a 4–6 word passphrase is the sweet spot. Avoid anything under 12 characters for accounts that matter — short passwords fall quickly to offline cracking regardless of how many symbols they contain.

Are these passwords truly random?+

Yes. The generator uses crypto.getRandomValues, the browser's cryptographically secure random number generator (CSPRNG), together with unbiased rejection sampling so every character is equally likely. It never uses Math.random, which is statistically predictable and unsuitable for anything security-related.

What does 'exclude ambiguous characters' do?+

It removes characters that are easy to misread or mistype — capital I, lowercase l, the digit 1, capital O, the digit 0, and the pipe |. This is helpful for passwords you'll read off a screen and type elsewhere (like a Wi-Fi key). It slightly shrinks the character pool, so the entropy figure updates to reflect the smaller set.

Should I use a password manager?+

Yes. The single most effective password habit is using a unique, long, random password for every account, and that's only practical with a password manager. Generate a long random password here, paste it into your manager, and let it remember and autofill. Protect the manager itself with a strong passphrase and two-factor authentication.

What do the crack-time estimates assume?+

They assume an attacker who already has the site's leaked password database and is guessing offline, and they show the average case (half the keyspace). The columns span throttled online attacks up to a massive offline cracking array. Sites that store passwords with a slow hash (bcrypt, scrypt, argon2) and enforce rate limits are far harder to attack than the fast-hash columns suggest, so treat the estimates as a worst-case yardstick rather than a precise prediction.

Download a one-page PDF of your numbers instantly. Add your email to also get our occasional calculator tips — no spam, unsubscribe anytime. Privacy.

★

Bonus

Entropy Strength Reference

Entropy	Rating	Roughly equivalent to	Good for
Under 28 bits	Very weak	A short PIN or a dictionary word	Nothing — cracked instantly
28–35 bits	Weak	An 8-char lowercase password	Throwaway, low-value logins only
36–59 bits	Fair	A 10–12 char mixed password	Low-stakes accounts
60–127 bits	Strong	A 16-char random password or 5-word passphrase	Email, banking, important accounts
128+ bits	Excellent	A 20+ char full-set password or 6+ word passphrase	Master passwords, encryption keys

Your Password

How to Use This Calculator

Pick a mode

Set your rules

Check the entropy

Copy and store it

Formula & Methodology

Key Terms Explained

Real-World Examples

An account stored in a password manager

A master password you must memorize

A typical human-chosen password

What Actually Makes a Password Strong

Length beats complexity

Entropy, explained

Passphrases versus passwords

Why a password manager — and why this runs in your browser

Frequently Asked Questions

Get a branded PDF of your results

Entropy Strength Reference

Entropy Strength Reference

Password Generator

Your Password

How to Use This Calculator

Pick a mode

Set your rules

Check the entropy

Copy and store it

Formula & Methodology

Key Terms Explained

Real-World Examples

What Actually Makes a Password Strong

Length beats complexity

Entropy, explained

Passphrases versus passwords

Why a password manager — and why this runs in your browser

Frequently Asked Questions

Get a branded PDF of your results

Entropy Strength Reference

Entropy Strength Reference

Keep Exploring

Related calculators

Guides & articles