Password Generator
Create a strong, random password with the exact character mix you need.
About This Tool
This generator builds passwords locally in your browser using the Web Crypto API's random number generator, which is designed for security-sensitive use.
How It Works
- Choose a password length with the slider.
- Pick which character types to include: uppercase, lowercase, numbers, and symbols.
- Click Generate Password to create a new random password instantly.
- Copy it with one click and paste it into your password manager or account form.
What This Tool Covers
- Adjustable length from 4 to 64 characters
- Toggle uppercase, lowercase, numbers, and symbols independently
- Option to exclude visually ambiguous characters like I, l, 1, O, 0
- Built-in strength meter for instant feedback
Why a Larger Character Set Helps
Every character position in a password is a slot that an attacker has to guess. If a password only uses lowercase letters, each slot has 26 possible values; add uppercase letters, numbers, and symbols, and each slot jumps to roughly 94 possible values. Since the total number of guesses an attacker has to try grows exponentially with each added possibility per slot, mixing character types makes a password dramatically harder to brute-force at the same length. That said, length matters more than variety — a longer password made of just lowercase letters can outlast a shorter one that uses every character type.
Password Entropy, Explained
Entropy measures how unpredictable a password is, expressed in bits. It's calculated as length × log₂(pool size) — the number of characters multiplied by the base-2 logarithm of how many possible characters could appear in each slot. A 12-character password using only numbers has about 40 bits of entropy; the same length using the full 94-character set has about 79 bits. Each extra bit doubles the number of guesses an attacker needs, so entropy grows fast: 60 bits is generally considered adequate for most accounts, and 80+ bits is a solid bar for anything sensitive. This tool's strength meter is a simplified stand-in for this calculation.
Common Password Mistakes
- Using personal information — birthdays, pet names, or addresses are easy for someone who knows you (or finds you online) to guess.
- Predictable substitutions — swapping "a" for "@" or "o" for "0" barely changes crack time, since cracking tools already check these patterns first.
- Reusing passwords across accounts — one breached site can expose every other account using the same password.
- Adding a number or symbol only at the end — "Password1!" is guessed almost as fast as "Password" because attackers try common suffixes automatically.
- Choosing a real word or short phrase — dictionary attacks test known words and leaked passwords before trying random combinations, so common words fall quickly regardless of length.
- Picking a password too short to matter — anything under 8 characters is crackable in hours or less today, no matter how the characters are mixed.
Strong vs. Weak Password Examples
These are illustrative examples only — never reuse a password you've seen published anywhere, including here.
- Weak:
summer2024— a real word plus a predictable number, easily caught by a dictionary attack. - Weak:
Password1!— a common word with the expected capital letter, digit, and symbol in the expected positions. - Stronger:
xT9#mQ2vL8&pR4z— 16 random characters across all four types, generated with no discernible pattern. - Stronger:
correct-harbor-lantern-42— a four-word passphrase with a separator and a number, long enough to resist brute-force despite using real words.
When to Use a Passphrase Instead
A passphrase strings together several unrelated random words, like "correct-harbor-lantern-42." It trades some entropy-per-character for being much easier to type and remember — useful for a device passcode, a Wi-Fi password you'll hand-type on a smart TV, or a master password you can't store anywhere. For accounts where a password manager will store and autofill the result, a fully random password from this generator packs more entropy into fewer characters and is the simpler default choice.
Password Length vs. Estimated Crack Time
The table below shows rough order-of-magnitude estimates for brute-forcing a fully random password, assuming an offline attack at 10 billion guesses per second — a realistic rate for modern GPU hardware against a fast, poorly-protected hash. Sites using strong password hashing (bcrypt, Argon2) push real-world times far higher; these numbers describe the mathematical worst case, not any specific service.
| Length | Numbers only | Lowercase only | Upper + lower + numbers | Full mix incl. symbols |
|---|---|---|---|---|
| 6 | Instant | Instant | ~3 seconds | ~34 seconds |
| 8 | Instant | ~10 seconds | ~3 hours | ~3.5 days |
| 10 | Instant | ~2 hours | ~1 year | ~85 years |
| 12 | ~50 seconds | ~55 days | ~5,100 years | ~755,000 years |
| 16 | ~5.8 days | ~69,000 years | ~76 billion years | ~59 trillion years |
| 20 | ~159 years | ~32 billion years | ~1.1 quintillion years | Far beyond the age of the universe |
Frequently Asked Questions
Is this password generator secure?
Yes. It uses your browser's cryptographically secure random number generator (crypto.getRandomValues), and passwords are never transmitted or saved.
What password length should I use?
12 characters is a reasonable minimum today; 16 or more is recommended for important accounts.
Should I use a passphrase instead of a random password?
Both can be secure. A passphrase (several random unrelated words) is easier to type and remember, while a fully random password like this tool generates packs more entropy into fewer characters. If you're storing the result in a password manager anyway, a random password is the simpler choice; if you need to type or recall it yourself, a passphrase may suit you better.
Should I use symbols in my password?
Including symbols increases the character pool and makes a password harder to guess, so it's recommended when a site allows it.
Is it okay to reuse the same password on multiple sites?
No — reusing passwords means a breach on one site can expose your account everywhere else it's used. Generate a unique password for every account and keep them in a password manager rather than trying to remember them all.
Does this tool store the passwords I generate?
No. Everything happens in your browser tab and nothing is saved or sent anywhere.
Related Tools
Strong Password Generator · PIN Generator · Username Generator