How many characters should a strong password have?

For a random password using all four types, 12 characters (about 78.7 bits) show as "Strong" and 16 characters (about 104.9 bits) as "Very strong". Going as long as the site allows is the most effective step.

How do I generate a random password with special characters?

Keep "Symbols" on. With "Include at least one of each chosen type" also on, every password contains at least one special character.

What if a site does not allow certain symbols?

Delete the symbols the site rejects from "Symbols to use" and only the rest are used. Letters, digits and spaces in that box are ignored.

Does the password generator save my passwords?

No. Passwords are made only in this browser, never sent to a server, and gone when you close the page.

What does leaving out look-alike characters do?

It removes five characters that are easy to confuse: capital O and zero, capital I, lowercase l and the digit 1. That helps when you copy a password by hand.

What is a passphrase?

A password made of several randomly chosen English words. Six words from a list of 7,776 give about 77.5 bits, similar to a 12-character random password.

How is password entropy calculated?

Length × log₂(number of possible characters). The formula is shown with your actual numbers under each result.

How many combinations does a 6-digit PIN have?

1,000,000, which is about 19.9 bits. PINs are usually protected by attempt limits, which is why short ones are used, but they are weak as a password.

Can I generate many random passwords at once?

Yes. Enter up to 50 under "How many" and use "Copy all" to copy them one per line.

Is it a problem if a PIN like 1234 comes up?

It is a genuinely random result, so such numbers can appear. If an easy-to-guess PIN bothers you, press "Generate new" for another one.

Password Generator — random & passphrase

Create strong random passwords from the length, letters, digits and symbols you choose, with entropy shown, or a memorable passphrase or PIN. Nothing is sent

Loading the tool…

A password generator that makes random passwords with the length and character types you choose. Besides strong random passwords mixing upper and lower case letters, digits and symbols, it makes easy-to-remember word passphrases and numeric PINs. Each result comes with its entropy in bits and the formula behind it, so you can judge how long is long enough, and nothing you generate leaves your browser.

How to use

On the "Password" tab, set the "Length" slider anywhere from 4 to 128 characters. It starts at 16.
Turn on the types to use: "Uppercase (A–Z)", "Lowercase (a–z)", "Digits (0–9)" and "Symbols". If the site accepts only some special characters, delete the others in the "Symbols to use" box.
If you will write the password down or read it out, turn on "Leave out look-alike characters (O 0 I l 1)". "Include at least one of each chosen type" is on from the start.
Enter 1 to 50 under "How many" to get that many passwords; each press of "Generate new" replaces them with fresh ones.
Press "Copy" on the line you like, or "Copy all" for the whole list. If someone is beside you, press "Hide" to mask the values on screen.
For a password that is easier to remember, choose "Words" and a "Separator" on the "Passphrase" tab; for digits only, choose the "Digits" count on the "PIN" tab.

How it works

Every character is picked with the browser's crypto.getRandomValues, without bias, so no character comes up more often than another.
Generated passwords are never sent or saved and disappear when you close the page. Only settings such as length and character types are remembered on this device.
Symbols are the 32 special characters you can type on a keyboard (! " # $ % and so on). With all four types on there are 94 possible characters, or 89 with look-alikes left out.
The strength grades are rough bands: under 28 bits "Very weak", under 36 "Weak", under 60 "Fair", under 100 "Strong" and above that "Very strong". They are not an official standard.
Passphrases use 3 to 12 words from the EFF Large Wordlist (7,776 English words, CC BY 3.0 US), and PINs can have 4, 5, 6, 8, 10 or 12 digits.

How long should a password be? Entropy by length

With all four types (94 characters), 8 characters give about 52.4 bits, shown as "Fair"; 12 characters about 78.7 bits, "Strong"; and 16 characters about 104.9 bits, "Very strong". Each extra bit doubles the number of possibilities. Assuming an attacker could make 10 billion guesses a second, trying every 8-character password from 94 characters (about 6.1 × 10^15) would take about a week, while 12 characters would take about 1.5 million years.

Length matters more than character types. Leaving symbols out and using only letters and digits (62 characters), 16 characters still give about 95.3 bits, more than 12 characters with symbols (about 78.7 bits). So when a site accepts only some special characters, or none, make the password longer instead. Sites differ in the rules they enforce and the maximum length they allow, so follow the sign-up page.

How password entropy is calculated

For a password whose characters are all chosen with equal probability, entropy is length × log₂(number of possible characters). Sixteen characters from 94 give 16 × log₂(94) ≈ 104.9 bits. This holds only for randomly generated passwords; a password a person makes up is much weaker at the same length because of words and patterns.

With "Include at least one of each chosen type" on, results that break the rule are thrown away and drawn again. Every password that meets the rule is therefore equally likely, and the entropy shown counts only those passwords, so it is a little lower: about 104.6 bits at 16 characters, some 0.3 bits less, and about 51.3 bits at 8 characters, roughly 1 bit less.

Passphrase vs random password: which is better?

A passphrase is a few words picked at random from a word list. Each word from a list of 7,776 adds log₂(7,776) ≈ 12.9 bits, so 4 words give about 51.7 bits, 5 words about 64.6 bits and 6 words about 77.5 bits. A 6-word passphrase is almost as strong as a 12-character random password from 94 characters, and far easier to say and remember.

"Add a digit" puts one digit after one of the words and adds log₂(10 × words), about 5.9 bits for 6 words. For sites that demand a digit or a capital letter, turn on "Add a digit" and "Capitalize each word". Separators do not add entropy in this calculation, and with "None" the true figure may be slightly lower because word boundaries can blur.

Is an online password generator safe to use?

Two things matter when choosing a password generator: the quality of its random numbers and where the result goes. This tool uses only crypto.getRandomValues, the browser feature meant for cryptographic randomness, and never sends or records what it makes. It does not use the general-purpose Math.random.

Put a new password straight into a password manager or your browser's password store. Using a different password for every site means a leak at one does not open your other accounts. If you copied a password on a shared computer, it may still be on the clipboard, so copy some other text to overwrite it.

Questions and answers

How many characters should a strong password have?: For a random password using all four types, 12 characters (about 78.7 bits) show as "Strong" and 16 characters (about 104.9 bits) as "Very strong". Going as long as the site allows is the most effective step.
How do I generate a random password with special characters?: Keep "Symbols" on. With "Include at least one of each chosen type" also on, every password contains at least one special character.
What if a site does not allow certain symbols?: Delete the symbols the site rejects from "Symbols to use" and only the rest are used. Letters, digits and spaces in that box are ignored.
Does the password generator save my passwords?: No. Passwords are made only in this browser, never sent to a server, and gone when you close the page.
What does leaving out look-alike characters do?: It removes five characters that are easy to confuse: capital O and zero, capital I, lowercase l and the digit 1. That helps when you copy a password by hand.
What is a passphrase?: A password made of several randomly chosen English words. Six words from a list of 7,776 give about 77.5 bits, similar to a 12-character random password.
How is password entropy calculated?: Length × log₂(number of possible characters). The formula is shown with your actual numbers under each result.
How many combinations does a 6-digit PIN have?: 1,000,000, which is about 19.9 bits. PINs are usually protected by attempt limits, which is why short ones are used, but they are weak as a password.
Can I generate many random passwords at once?: Yes. Enter up to 50 under "How many" and use "Copy all" to copy them one per line.
Is it a problem if a PIN like 1234 comes up?: It is a genuinely random result, so such numbers can appear. If an easy-to-guess PIN bothers you, press "Generate new" for another one.