Password Generator

About this Password Generator

The Password Generator uses the browser’s cryptographic random-number API when available to create a random sequence from the selected character set. You can choose length and whether the pool includes letters, numbers and symbols.

A password's real-world strength depends on both its length and the size of the character set it draws from; a longer password with only lowercase letters can still be weaker than a shorter one that mixes uppercase, numbers and symbols, because the total number of possible combinations depends on both factors together.

For related tasks, try Random Number Generator, UUID v4 Generator or Caesar Cipher Encoder / Decoder.

How to use it

1. Choose a password length.
2. Choose the character set.
3. Generate and copy the password, then store it securely in a password manager if needed.

Practical example

A 16-character password using upper- and lowercase letters, numbers and symbols has a much larger possible search space than a short common word.

A 16-character password drawn from letters, numbers and symbols has roughly 94^16 possible combinations, an astronomically large search space compared to an 8-character password from the same character set, which is one reason security guidance increasingly favors longer passwords over just adding more symbol complexity to short ones.

Things to double-check

Even a strong randomly generated password becomes weak if it's reused across multiple accounts, since a single data breach at one service can expose it for use elsewhere. Pairing this generator with a password manager that stores a unique password per account is significantly more effective than memorizing one strong password and reusing it everywhere.

Length beats cleverness

The strength of a random password comes mainly from its length. Each character chosen from the full set of about 94 printable symbols adds roughly 6.5 bits, so 16 characters give about 105 bits of randomness. A 12 character password using only letters and digits has about 71 bits. Each extra character multiplies the number of guesses an attacker needs by the size of the character set, so a longer password is far stronger than a short one with a few symbols swapped in.

How the passwords are made

The generator uses your browser's cryptographic random number source, which is designed to be unpredictable, instead of an ordinary random function. The password is created on your device and is not sent anywhere. Even so, copy it straight into a password manager and avoid pasting it into chat or email. Close the page when you are done, and do not reuse it elsewhere.

Unique passwords and password managers

Use a different password for every account. If one site is breached, attackers try the same login on other sites, a method called credential stuffing. Nobody can remember dozens of random passwords, so use a reputable password manager to store them and protect it with a strong master passphrase. A passphrase of four or five random words is easier to remember and can also be strong.

Beyond the password

Turn on two-step verification wherever it is offered, preferably with an authenticator app or a hardware key instead of text messages. Check whether your email address has appeared in a known breach and change any password involved. Be careful with sites that limit length or ban symbols, and pick the longest option they allow. Never share passwords, and be wary of emails asking you to log in through a link.

If a service is breached

If a site tells you that it has been breached, change the password there at once and change it anywhere else you used it. Turn on two-step verification, check your email account for unfamiliar logins and watch for phishing messages that mention the breach. Passkeys, where a site supports them, are a newer option that uses your device instead of a typed password and resists phishing, so use them when offered. Review the passwords stored in your manager from time to time and replace weak or old ones.

Worked example: how strong is a password?

Strength is measured in bits of randomness. A password of 12 characters chosen at random from 62 letters and digits has 62 to the power of 12 possibilities, about 71.5 bits. A 16 character password drawn from about 94 printable symbols has about 105 bits. A passphrase of four words picked at random from a list of 7,776 words, as in the Diceware method, has about 51.7 bits, and six words has about 77.5. Each extra bit doubles the number of guesses needed. Use at least 70 bits for important accounts, and more for a password manager's master password.

Random strings versus passphrases

A random string is the strongest for its length and is ideal for passwords stored in a manager, which you never need to type. A passphrase of random words is easier to remember and type, which makes it suitable for the few passwords that you must memorise, such as the master password, a device login or an encryption passphrase. The words must be chosen randomly, not made up by you, since people choose predictable phrases. Adding a few more words is the simplest way to strengthen a passphrase, and long length matters more than substitutions such as an at sign for the letter a.

Managers, two-step verification and passkeys

Use a reputable password manager to create and store a unique password for every account, and protect it with a strong master password and two-step verification. Prefer authenticator apps or hardware keys to text message codes, which can be intercepted. Passkeys, now supported by many services, replace the password with a cryptographic key stored on your device and unlocked by your fingerprint, face or PIN, and they cannot be phished in the same way. Keep recovery codes in a safe place, and set up a trusted contact or backup method in case you lose a device.

Habits to avoid

Avoid passwords based on names, birthdays or pets, patterns such as keyboard rows, and small variations of an old password. Do not reuse a password across sites, since a breach of one exposes all. Do not share passwords in chat or email, and be cautious about security questions, whose answers are often easy to find; treat them as extra passwords and give random answers stored in your manager. Beware of phishing messages that ask you to log in through a link, and go to the site directly instead. Check from time to time whether your email address appears in a known breach.

Key terms explained

A password is a secret used to prove identity. Entropy measures unpredictability in bits. A random generator produces values that cannot be guessed. A passphrase is a password made of several words. A password manager stores unique passwords securely. Two-step verification adds a second proof such as a code. A passkey replaces the password with a cryptographic key on a device. Credential stuffing uses leaked passwords on other sites. Phishing tricks users into giving up passwords.

Rules of thumb and quick checks

Aim for at least 14 characters for ordinary accounts and 20 or more for a master password. A 16 character random password has about 105 bits, and a six-word passphrase about 77 bits. Use a different password for every account, and enable two-step verification where you can. Never reuse a password, never share one in chat and replace any password involved in a breach.

Frequently asked questions