Password Generator

Make a password no one can guess: up to 128 characters, every character type you pick guaranteed to appear, and a live strength meter showing entropy bits and how long it would take to crack.

How Password Strength Really Works: It's About Guessing Work

A strong password isn't one that looks complicated — it's one that takes an attacker longer to guess than they'll ever bother trying. Every password's strength is just math: how many possible passwords exist in the space it was drawn from, and how fast someone can try them. A password drawn from a bigger space with more characters lasts exponentially longer. This is why password advice has changed over the years: security experts stopped caring about “must contain a symbol” rules and started caring about one thing above all — length, drawn from a large, random space. This generator builds passwords exactly that way: each character is picked independently and at random, so the result has no pattern, no dictionary word, and no personal information for an attacker to exploit.

The size of the character pool matters enormously. Lowercase letters alone give 26 possibilities per character. Add uppercase and you get 52. Add digits: 62. Add symbols like !@@#$: about 94. Each character you add multiplies the total possibilities by the pool size — so a 12-character password from the full 94-character pool has 94¹² possible combinations, a number with 24 digits. Security people measure this in “bits of entropy”: each bit doubles the attacker's work. A 60-bit password means about a quintillion guesses; an 80-bit password means a thousand times more than that. The meter on this page shows your password's entropy in bits, so you can see the strength as a number instead of guessing from how the password looks.

Length beats complexity every time. Compare: an 8-character password using all 94 symbols has about 52 bits of entropy. A 20-character password using only lowercase letters has about 94 bits — roughly 16 billion times harder to guess, despite “looking” simpler. This is the single most misunderstood fact in password security, and it's why the generator defaults to 16 characters: length is doing the heavy lifting, and the mixed character types are a bonus. If a website limits you to shorter passwords, that's when enabling every character type matters most — with only 10 characters allowed, you want all 94 symbols in play.

Where the randomness comes from matters as much as the math. This generator uses your browser's cryptographic random number generator — the same source your operating system uses to create encryption keys — not the weaker random functions found in many quick scripts, which can produce predictable sequences. Just as important: generation happens entirely inside your browser. The password is never sent over the network, never stored on a server, never logged. When you press Generate, the only copies that exist are the one on your screen and the one in your memory — or your password manager, where it belongs.

The “crack estimate” on the strength meter translates entropy into time. It assumes an attacker with serious hardware guessing billions of passwords per second — far beyond what a normal login page allows, but realistic for someone who stole a database of scrambled passwords. When the meter says “centuries,” it means the password will outlive the account, the company, and probably the attacker. When it says “minutes,” change it today. Treat the estimate as a ranking, not a promise: real attackers also try stolen passwords from other breaches first, which is why every password must be unique — a perfect 105-bit password reused on two sites is only as safe as the weaker site's security.

Worked Example: What 16 Random Characters Buy You

Choosing the Right Settings for Each Account

Not every account needs the same password, but every account needs its own. For email, banking, and anything holding money or identity documents: 16–20 characters, all four character types, stored in a password manager, with two-factor authentication switched on. For everyday accounts (forums, newsletters, shopping): 12–16 random characters, unique per site — the generator's default 16 is perfect. For Wi-Fi passwords you must read aloud to guests, tick “exclude look-alikes” so nobody confuses 0 with O or 1 with l over the phone. For sites with picky rules (“no symbols” or “symbols not allowed: $%@@”), use the custom-exclusion box to drop exactly the characters the site rejects, rather than turning symbols off entirely — keeping the other symbols preserves most of your entropy. And when a site caps length at 8 or 10, enable every character type and accept the shorter password only there, nowhere else.

The “no repeated characters” option exists for the handful of sites whose rules forbid repeats — it slightly shrinks the guessing space, but a 16-character no-repeat password is still enormously strong. Generate a few at once with the quantity selector and pick the one you dislike least; you'll never type it anyway, since the manager will. The goal of every setting here is the same: maximum entropy the site will accept, minimum effort from you.

Common Password Mistakes

Most account break-ins don't involve brilliant hacking — they involve predictable human habits. Here are the ones to kill:

• Reusing one password everywhere. The number-one password sin, by a mile. When (not if) one site gets breached, attackers automatically try the stolen email-and-password pairs on banks, email, and shopping sites — a technique called credential stuffing. Your 105-bit masterpiece is worthless if it's also the key to five other doors. Unique password per site, no exceptions; that's the entire job of a password manager.
• “Clever” substitutions. P@@ssw0rd, Tr0ub4dor&! and M0nk3y! feel creative, but every common substitution is in the attacker's dictionary — they were trying l33t-speak before you were born. Human-patterned passwords fall to pattern-aware guessing in minutes to hours. If a human invented the pattern, assume software already knows it. Only true randomness, like this generator produces, has no pattern to exploit.
• Short passwords with lots of symbols. An 8-character password with every symbol type has around 52 bits of entropy — a determined attacker with a stolen database cracks it in hours. Symbols don't rescue short length. If a site forces short passwords, that's a reason to use the maximum allowed length with all character types — not a reason to feel safe with 8 characters.
• Storing passwords in plain sight. Notes apps, screenshots, spreadsheets, sticky notes, and chat messages to yourself are all one lost phone or one nosy glance away from exposure. A password manager encrypts everything behind one strong master password — it's the only sane place for dozens of unique random passwords. This page's in-visit history exists only while the tab is open; move passwords into the manager, then close the tab.
• Changing passwords on a timer for no reason. Forced 90-day rotations were retired from official security guidance years ago, because they train people to make tiny predictable changes (Winter2025! becomes Spring2026!). Change a password when there's a reason: a breach notice, a phishing scare, or sharing it with someone. Otherwise, a strong unique password can stand for years.
• Skipping two-factor authentication. A password — even a perfect one — is a single factor, and phishing defeats passwords entirely by tricking you into typing yours on a fake site. Two-factor (an authenticator app or security key) means a stolen password alone isn't enough. Enable it on email, banking, and anything holding money or identity documents. Think of the password as the lock and two-factor as the deadbolt.
• Emailing or texting passwords. Every password sent through chat, email, or a shared doc lives forever in inboxes, backups, and screenshots. If you must share access (a family streaming account), use your password manager's sharing feature or say it once in person — then change it when the sharing ends.

The modern password strategy fits in one sentence: a password manager holding long, random, unique passwords, plus two-factor on everything important. This generator handles the “long and random” part in one click; the manager handles the remembering; you handle turning on two-factor. Do those three things and password security stops being a source of anxiety and becomes a solved problem.

Frequently Asked Questions

Related Calculators

Last reviewed: November 3, 2026 · Formulas verified for accuracy.