Home / Everyday / Password Generator
Random Password Generator
Set the length and the character types, then generate several random passwords at once. Each one is built with the browser's cryptographic random source, and the page shows its entropy in bits so you can judge its strength.
How the passwords are generated
The generator uses crypto.getRandomValues, the browser's cryptographically secure random number source, rather than the ordinary Math.random, which is not designed to be unpredictable. Picking one character from a pool of size k uses rejection sampling: random 32-bit values that would make some characters slightly more likely than others are thrown away, so every character in the pool is equally likely.
One character from each selected type is placed first so the result always meets common site rules, then the remaining positions are filled from the whole pool, and the positions are shuffled with the same unbiased random source. The passwords are created by code running in your browser on this page.
What entropy means
Entropy measures how many equally likely possibilities an attacker would have to search. For a password built from a pool of N characters with length L, the number of possibilities is NL, and the entropy in bits is:
bits = L × log2(N)
Every extra bit doubles the number of guesses. A 16-character password using all four types from the default pool of 85 characters has about 102.6 bits, while an 8-character password of lowercase letters only has about 37.6 bits. Length helps more than variety: adding four characters to a password raises its strength far more than swapping a letter for a symbol.
| Pool | Characters | Bits per character |
|---|---|---|
| Digits | 10 | 3.32 |
| Lowercase | 26 | 4.70 |
| Letters, both cases | 52 | 5.70 |
| Letters and digits | 62 | 5.95 |
Using passwords safely
- One password per account. Reuse lets one breach unlock many accounts. A password manager removes the need to memorise them.
- Prefer length. Guidance such as NIST SP 800-63B favours longer passwords and checking them against known breached lists over arbitrary composition rules.
- Turn on two-factor authentication wherever it is offered, because a strong password can still be phished.
- Never share a password by email or chat, and do not use personal facts such as birthdays, which can be guessed.
Entropy only describes randomly generated passwords. A password you invent yourself, however clever it looks, is usually much weaker than its length suggests.
Limits
Some sites restrict which symbols are accepted or cap the length. If a site rejects a symbol, exclude symbols and add length to compensate. The strength label is a rough guide to guessing difficulty and does not account for how a service stores your password, whether it limits login attempts, or whether your device is already compromised.
Worked example
A 20-character password with letters and digits but no symbols, with look-alike characters removed so it is easy to read aloud or copy by eye.
Inputs
| Password length | 20 |
|---|---|
| Uppercase letters (A-Z) | Include |
| Lowercase letters (a-z) | Include |
| Digits (0-9) | Include |
| Symbols | Exclude |
| Look-alike characters (I, l, 1, O, 0) | Remove them |
| How many passwords | 3 |
Result
About 116.7 bits of entropy (Very strong). Generate again for a new set.
| Length | 20 |
|---|---|
| Character pool size | 57 |
| Entropy | 116.7 bits |
| Possible combinations | 2^117 (about 10^35) |
Generated passwords
| # | Password |
|---|---|
| 1 | hGXjQH54vvkisPuJHCFF |
| 2 | gCi2NWt3ajDwDshT2Ens |
| 3 | dQKXDGhcaPZfcRe59SWC |
- Entropy is length × log2(pool size). Requiring one character of each chosen type removes a small number of combinations, so the true figure is marginally lower.
- Store generated passwords in a password manager and use a different one for every account.
Accuracy note: Results are calculated in your browser from the values you enter. Check anything that matters for legal, academic or financial purposes against the official source.
Frequently asked questions
Are the passwords generated here sent anywhere?
The passwords are created by code running in your own browser using its secure random source. The calculation does not need to send them to a server, but you should still treat any password you copy as sensitive.
How long should a password be?
Longer is better. For accounts that matter, 16 or more random characters is a sensible choice, and a password manager makes that practical because you do not have to remember it.
Why remove look-alike characters?
Characters such as I, l, 1, O and 0 are easy to confuse when read or typed by hand. Removing them lowers the entropy slightly, which you can offset with a longer password.
What does 80 bits of entropy mean?
It means about 2 to the power 80 equally likely passwords are possible, so an attacker would on average need to try half of them. Each added bit doubles the search.
Is a passphrase better than a random password?
A passphrase of several randomly chosen words can be strong and easier to remember. This tool builds character-based passwords, which pack more entropy into fewer characters.