Password Generator

Generate strong, secure random passwords with custom length and character sets.

Password length: 16

Number of passwords

Character sets

Uppercase (A–Z) Lowercase (a–z) Digits (0–9) Symbols (!@#…)

What makes a password strong?

Password strength is determined by entropy — the mathematical measure of unpredictability. A password with more possible combinations takes exponentially longer to crack by brute force. Length is the single biggest factor: each additional character multiplies the number of possible combinations by the size of the character set. A 16-character random password from a 95-character set has more entropy than any human-chosen phrase.

Entropy = log₂(charset_size^length)

Example with 94-character set (uppercase + lowercase + digits + symbols):
  8 chars:  log₂(94⁸)  = 52.4 bits  → crackable in hours (modern GPUs)
  12 chars: log₂(94¹²) = 78.6 bits  → centuries to crack by brute force
  16 chars: log₂(94¹⁶) = 104.9 bits → beyond practical brute-force

Rule of thumb: aim for ≥ 72 bits of entropy for important accounts

Password cracking: how attackers work

Dictionary attack

Tests words from dictionaries and known password lists. Defeats: any recognisable word, even with letter substitutions (p@ssw0rd).

Brute force

Systematically tries every character combination. Slower than dictionary but guaranteed to work eventually. Long passwords make this impractical.

Credential stuffing

Uses leaked username/password pairs from data breaches to log into other sites. Defeated by unique passwords per site.

Rainbow tables

Pre-computed hash lookups. Defeated by password salting (modern systems do this automatically) and sufficient entropy.

Password security best practices

Use a password manager. 1Password, Bitwarden, and Dashlane generate and store unique strong passwords for every site. You only remember one master password.
Never reuse passwords. If one site is breached, credential stuffing attacks immediately test your password on every other site. Unique passwords limit breach damage to one account.
Enable two-factor authentication (2FA). Even a weak password becomes dramatically harder to exploit when TOTP codes or hardware keys are also required.
Length beats complexity for memorised passwords. "correct-horse-battery-staple" (a random 4-word passphrase) has more entropy than "P@ssw0rd!" and is far more memorable.

Frequently asked questions

How long should my password be?

At least 12–16 characters. Length adds more security than complexity — each extra character exponentially increases the time needed to crack it.

Are these passwords stored anywhere?

No. They are generated in your browser using random values and are never transmitted or saved by this site.

What makes a password strong?

High entropy — a long, random mix of upper- and lowercase letters, digits and symbols, and a different password for every account.

Should I use a password manager?

Yes. A password manager generates and stores a unique strong password for every site, so you only need to remember one master password.

What this tool does

Generates cryptographically random passwords using browser-native Math.random. Choose the length and which character sets to include. Longer passwords with all character types are exponentially harder to crack.

Input fields explained

Password length

The number of characters in each password. 12 is the minimum for security. 16–20 is recommended for important accounts. 32+ for high-security credentials like API keys.

Number of passwords

How many passwords to generate in one batch. Useful for generating options to choose from.

Character sets

Uppercase (A–Z), lowercase (a–z), digits (0–9), and symbols (!@#…). Each set you add exponentially increases the number of possible passwords and security. Symbols double the effective keyspace.

💡 Tips & context

→A 16-character password with all sets has more combinations than atoms in the observable universe.

→Never reuse passwords across sites. Use a password manager.

Formula / How it works

Characters selected randomly from chosen sets. 16-char password with all sets = ~10²⁶ combinations.