What is Password Generator?
A Password Generator creates cryptographically random passwords using your browser's built-in cryptographic random number generator. Choose your desired length and which character types to include — uppercase letters, lowercase letters, digits, and symbols — to produce passwords that meet both strength requirements and website-specific rules. Each generated password comes with an entropy score measured in bits, giving you a precise, quantitative measure of how resistant it is to brute-force and offline dictionary attacks. Whether you need a quick single-use password or a long-term master password for a password manager, this tool delivers cryptographically secure output without ever transmitting data to a server.
When to Use This Calculator
- Creating a new account — generate a unique, high-entropy password for every new service you sign up for.
- Replacing weak or compromised passwords — audit your existing passwords and replace any short, predictable, or reused ones.
- Setting up a password manager — generate your master password with maximum length and all character types enabled.
- Generating API keys or tokens — produce cryptographically random credentials for development and deployment.
- Securing shared or team accounts — create a strong password that multiple team members can store in a shared vault.
- Meeting website password requirements — adjust character type toggles to match specific site rules while keeping maximum length.
Steps:
- Set the desired password length using the slider (8–128 characters). Longer passwords are exponentially stronger.
- Toggle which character types to include: uppercase (A-Z), lowercase (a-z), numbers (0-9), and special characters (!@#$%^&*).
- Click the Generate button to create a cryptographically random password.
- Review the entropy score, strength rating, and estimated crack time displayed below the generated password.
- Copy the password to your clipboard and store it in a password manager.
Formula
Entropy (bits) = length × log₂(pool size)
Character pool sizes:
- Uppercase only: 26 characters → log₂(26) ≈ 4.7 bits per character
- Lowercase only: 26 characters → log₂(26) ≈ 4.7 bits per character
- Digits only: 10 characters → log₂(10) ≈ 3.3 bits per character
- All printable ASCII: 95 characters → log₂(95) ≈ 6.6 bits per character
Strength thresholds:
- < 40 bits = Very Weak (instantly crackable)
- 40–59 bits = Weak (minutes to hours)
- 60–79 bits = Fair (days to years)
- 80–99 bits = Strong (centuries)
- 100+ bits = Very Strong (effectively uncrackable)
Use Cases
- Creating new account passwords for websites, apps, and online services
- Generating secure API keys, access tokens, and session identifiers
- Replacing weak, reused, or potentially compromised passwords
- Creating unique passwords for each service to limit breach impact
- Building a password manager vault with strong, diverse credentials
Key Benefits
- Generate cryptographically random passwords using the browser's secure random API — no data leaves your device.
- Customize password length from 8 to 128 characters and toggle uppercase, lowercase, numbers, and symbols independently.
- View real-time entropy score in bits plus a strength rating (Weak through Very Strong) for every generated password.
- Get estimated crack time based on current offline attack benchmarks — know exactly how long your password would resist a brute-force attempt.
- One-click copy to clipboard for instant use — no manual typing required.
- Completely free with no account, no ads, and no server-side processing.
Pro Tips
- Aim for at least 16 characters for general accounts and 20+ characters for high-value targets like email, banking, and your password manager master password.
- Always maximize length before adding character diversity — a 24-character lowercase-only password (≈113 bits) is stronger than a 10-character mixed-type password (≈65 bits).
- Use a password manager (e.g., Bitwarden, 1Password, KeePass) to store every unique generated password so you never have to remember or reuse them.
- Enable two-factor authentication (2FA) on all important accounts — even a strong password can be compromised through phishing or data breaches.
- Never reuse passwords across accounts — a breach on one site exposes every account using that same password.
Common Mistakes to Avoid
- Using personal information such as names, birthdays, pet names, or addresses — these are the first things attackers try in targeted attacks.
- Making passwords too short — anything under 12 characters is vulnerable to brute-force attacks with modern hardware.
- Reusing the same password across multiple accounts — a single breach exposes every account that shares that password.
- Using common substitutions like P@ssw0rd or Tr4ub13d0r — modern cracking tools recognize and test these predictable patterns automatically.
Key Terms Explained
- Entropy: A measure of password unpredictability in bits, calculated as length × log₂(character pool size). Higher entropy means exponentially more combinations an attacker must try.
- Character pool: The total set of characters available for password generation — uppercase (26), lowercase (26), digits (10), and symbols (~32) combine to a pool of up to 95 characters.
- Brute-force attack: An attack method that systematically tries every possible character combination until the correct password is found, scaled by available computing power.
- Passphrase: A password composed of multiple random words (e.g., correct-horse-battery-staple) that is both strong and easier to remember than random character strings.
- Password manager: Software that generates, encrypts, stores, and autofills unique strong passwords for all your accounts behind a single master password.
Related Concepts
- Password Entropy: A quantitative measure of password unpredictability in bits — each additional bit doubles the number of combinations an attacker must try.
- Character Pool: The set of characters used to generate a password — using all four types (uppercase, lowercase, digits, symbols) creates a pool of up to 95 characters.
- Brute Force Attack: An attack that tries every possible combination systematically — resistance is determined by password entropy and the attacker's computing speed.
- Password Manager: Software that generates, stores, and autofills unique strong passwords for every account behind one master password.
- Two-Factor Authentication (2FA): An additional security layer requiring a second verification step (like a phone code or hardware key) beyond your password.
- Passphrase: A sequence of random words used as a password — diceware and EFF word lists provide standardized word pools for generating strong passphrases.
Example
A 16-character password using all four character types draws from a pool of 95 characters. The total password space is 95^16 ≈ 4.4 × 10^31 combinations. At a modern offline cracking speed of 100 billion guesses per second (10^11), exhaustively searching this space would take approximately 1.4 × 10^13 years — roughly 1,000 times the age of the universe.
Interpreting Your Results
The entropy score is the single most reliable indicator of password strength. Aim for 60+ bits for low-risk accounts, 80+ bits for general-purpose accounts, and 100+ bits for critical accounts like email, banking, and your password manager master password.
Length matters more than character diversity. A 20-character lowercase-only password has approximately 95 bits of entropy — stronger than a 10-character password using all character types (approximately 65 bits). Always maximize length first, then layer in character diversity for additional strength.
The strength meter provides a quick visual reference, but the entropy number tells the precise story. Two passwords using identical character sets but differing in length by just 4 characters will have vastly different entropy scores. A password rated 'Strong' at 80+ bits is sufficient for most accounts; 'Very Strong' at 100+ bits is ideal for your most sensitive credentials.
Pair this generator with a password manager for maximum security. Generate a unique password for every account, store them all encrypted in your manager, and never reuse or share passwords in plain text.