Password Generator

What a strong password really is

A strong password is one that is hard to guess and hard to crack by brute force, which in practice means it is long and drawn at random from a large set of characters. This generator builds exactly that: it picks each character independently from the pools you enable (lowercase, uppercase, digits, symbols) using a cryptographically secure random source, then reports how much guessing effort the result represents.

The single biggest lever is length. Adding one character to a password multiplies the number of possibilities by the size of the character pool, while swapping a letter for a symbol only adds a little. A 20-character random password is far stronger than a clever 8-character one, and far easier to store in a password manager than to remember, which is the modern recommendation.

It also matters that the password is genuinely random. Human-chosen passwords cluster around names, dates, keyboard walks, and dictionary words, so an attacker can try the likely candidates first and skip most of the theoretical search space. A generator removes that bias by drawing every character independently, which means the full entropy figure is real rather than optimistic.

Random passwords versus passphrases

There are two good strategies, and they suit different needs. A random password like the output of this tool packs the most entropy into the fewest characters, which is ideal when you paste it into a password manager and rarely type it. A passphrase made of several unrelated words (for example five random words from a long list) is far easier to type and remember, at the cost of being longer on screen.

Both can be strong. The classic XKCD "correct horse battery staple" point is that four to six truly random common words can exceed the entropy of a short symbol-heavy password while staying memorable. Use a passphrase for the handful of secrets you must type from memory, such as your device login or password-manager master password, and use long random strings for everything the manager stores for you.

How the strength is calculated

Strength is measured in bits of entropy: the base-2 logarithm of the total number of passwords your settings could produce. More bits means exponentially more work for an attacker, because each extra bit doubles the search space.

Pool size  N = (26 if lowercase) + (26 if uppercase)
              + (10 if digits) + (~24 if symbols)
Entropy    H = length x log2(N)        (bits)

Example pools:
  lowercase only            N = 26   -> 4.70 bits per character
  lower + upper + digits    N = 62   -> 5.95 bits per character
  all four classes          N = ~86  -> 6.43 bits per character

The tool labels the result: under 40 bits is weak, 40 to 60 is okay, 60 to 80 is strong, and above 80 bits is very strong. Excluding ambiguous characters lowers N slightly, so the per-character entropy drops a touch and you may want a few more characters to compensate.

Worked example: a 20-character password

Suppose you keep the defaults: length 20 with lowercase, uppercase, digits, and symbols all enabled.

1. Character pool: 26 + 26 + 10 + 24 = about 86 possible characters.
2. Entropy per character: log2(86) = about 6.43 bits.
3. Total entropy: 20 x 6.43 = about 128 bits.
4. Search space: 86^20, roughly 2^128, which is around 3 x 10^38 possible passwords.
5. Label: well above 80 bits, so the tool reports "Very strong".

Length and entropy reference

Approximate entropy for passwords using all four character classes (pool of about 86), with a rough strength label.

Common pitfalls

• Reusing one password everywhere. A breach of one site then unlocks all of them through credential stuffing. Generate a unique password per account.
• Choosing length 8 because a site allows it. Minimums are floors, not targets. Use 16 or more wherever the field permits.
• Substituting predictable leetspeak. Turning "password" into "p@ssw0rd" adds almost no real entropy because cracking tools know every common substitution.
• Trusting a weak random source. Passwords built from Math.random or a timestamp are guessable. This tool uses crypto.getRandomValues precisely to avoid that.
• Storing the password in plain text. A note file or browser autofill without a master password is a weak link. Use a dedicated password manager.
• Skipping two-factor authentication. Even a perfect password is only one layer. Add an authenticator app or hardware key on important accounts.

Related tools

Frequently asked questions