Password Generator
- Updated
- Formula shown
- Free, no sign-up
Loading…
How to use the password generator
- Choose Random characters or Passphrase (words).
- For characters, set the length (8 to 128) and the character types. For a passphrase, set the number of words and a separator.
- Press Copy and paste the password straight into your password manager or the sign-up form. Press Generate new for another.
How your password is generated, and what happens to it
The password is made by JavaScript running on this page, using the browser's Web Crypto API, crypto.getRandomValues, a cryptographically
secure generator seeded by your operating system. Each character (or word) is picked by rejection sampling: the generator takes just
enough random bits to cover the list and draws again if the result falls outside it, so every character is exactly equally likely. "At least one of each
type" works the same way: a password that misses a type is thrown away whole and a new one is drawn, which keeps every acceptable password equally likely.
Your settings decide only the alphabet and the length; the password itself is never worked out from them. It is not sent to our server, not included in analytics, not saved to your account and not added to the page address, and the Share, Save and Download buttons are switched off on this page. Reloading the page gives a new password.
Password entropy formula
random characters: entropy = L × log₂(N)
passphrase: entropy = W × log₂(7,776) ≈ W × 12.925
L is the length, N the number of characters to choose from and W the number of words. Entropy is exact here because the password is truly random: each extra bit doubles the number of possibilities an attacker would have to try. When every type is required, the calculator counts only the passwords that contain each type, using inclusion–exclusion, so the figure is slightly lower than L × log₂(N).
Worked example
A 20-character password from all 94 printable ASCII characters has 20 × log₂(94) = 131.1 bits. Requiring at least one uppercase letter, lowercase letter, digit and symbol trims that only to 130.9 bits. A 16-character password of letters and digits has 95.3 bits, and a six-word EFF passphrase has 6 × 12.925 = 77.5 bits, one of 2.2 × 10²³ possibilities, while being far easier to type on a phone.
Entropy by length and character set
| Characters | 8 | 12 | 15 | 16 | 20 | 24 | 32 |
|---|---|---|---|---|---|---|---|
| Digits only (10) | 27 bits | 40 bits | 50 bits | 53 bits | 66 bits | 80 bits | 106 bits |
| Lowercase (26) | 38 bits | 56 bits | 71 bits | 75 bits | 94 bits | 113 bits | 150 bits |
| Letters and digits (62) | 48 bits | 71 bits | 89 bits | 95 bits | 119 bits | 143 bits | 191 bits |
| All printable ASCII (94) | 52 bits | 79 bits | 98 bits | 105 bits | 131 bits | 157 bits | 210 bits |
Adding characters helps much more than adding symbol types: going from 12 to 16 letters and digits adds more entropy than switching 12 letters and digits to all 94 characters.
EFF passphrases by number of words
| Words | Entropy | Possible passphrases |
|---|---|---|
| 4 | 51.7 bits | 3.7 × 10¹⁵ |
| 5 | 64.6 bits | 2.8 × 10¹⁹ |
| 6 | 77.5 bits | 2.2 × 10²³ |
| 7 | 90.5 bits | 1.7 × 10²⁷ |
| 8 | 103.4 bits | 1.3 × 10³¹ |
| 10 | 129.2 bits | 8.1 × 10³⁸ |
What NIST recommends
- Length matters most. NIST SP 800-63B-4 (July 2025) calls length "a primary factor in characterizing password strength". A password used on its own should have at least 15 characters; 8 is the minimum only when it is one part of multi-factor sign-in.
- No forced mixtures or regular changes. The guidelines tell services not to impose composition rules or periodic password changes, and to accept at least 64 characters. Some sites still demand a mix, which is why the generator offers one.
- One password per account. A random password is only as safe as the site storing it. Use a different one everywhere, keep them in a password manager, and turn on multi-factor authentication where you can.
We don't show "time to crack" estimates. They depend on how a site stores passwords, the attacker's hardware and whether the site limits guesses, so any single number would be misleading. Entropy is the honest measure for a random password: more bits is better, and every 10 bits multiplies the work by about a thousand.
Need random numbers instead? The random number generator uses the same secure method. To encode data, see the Base64 encoder and decoder.
Sources and credits
- NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025), section 3.1.1.2 and Appendix A.
- Passphrase words: EFF Large Wordlist for Passphrases by Joseph Bonneau, Electronic Frontier Foundation (2016), 7,776 words, used unchanged under a Creative Commons Attribution license (CC BY).
- W3C, Web Cryptography API:
getRandomValues.
Frequently asked questions
Is it safe to generate a password on a website?
Here the password is made by code running in your own browser with crypto.getRandomValues, and it is never sent to a server, logged, saved or put in the page address. Copy it straight into a password manager, and use a different password for every account.
How long should my password be?
NIST SP 800-63B-4 sets a minimum of 15 characters for a password used on its own, and 8 only when it is part of multi-factor sign-in. A random 16-character password of letters and digits has about 95 bits of entropy; 20 characters from all 94 printable characters have about 131 bits.
What is password entropy?
It is log₂ of the number of equally likely passwords the generator could have made, so each extra bit doubles an attacker’s work. For random characters it is length × log₂(pool size): 12 lowercase letters give 12 × log₂(26) ≈ 56.4 bits. It only describes randomly generated passwords, not ones people choose.
Are passphrases as strong as passwords?
They can be. Each word from the 7,776-word EFF list adds log₂(7,776) ≈ 12.9 bits, so six words give about 77.5 bits, close to a 12-character password from all 94 printable characters (about 78.7 bits), and seven words give about 90.5 bits. Passphrases are much easier to type and remember.
Does requiring symbols and numbers make a password stronger?
Only a little. Length matters far more: going from 12 to 16 letters and digits adds about 24 bits, while switching 12 letters and digits to all 94 characters adds about 7. NIST now tells sites not to require mixtures of character types, but the generator can include every type for sites that still ask.