16 Character Password Generator

Why 16 characters is the common recommendation

Sixteen characters over a mixed alphabet gives roughly 103 bits of entropy. At 100 billion guesses a second — an offline attack against a stolen password database using commodity hardware — exhausting that space takes longer than the universe has existed. There is no practical attack against a random password of this length.

It has become the default advice because it sits at a useful boundary: long enough that the arithmetic stops being interesting to an attacker, short enough that most systems accept it. Plenty of older platforms silently truncate at 16 or 20 characters, and a password that gets cut in half without telling you is worse than a shorter one you chose deliberately.

Note the wording on many sites. "16 digits" usually means 16 characters, not 16 numerals — a genuinely digit-only password of that length is about 53 bits, which is roughly a hundred billion times weaker. If a form specifically demands numerals, use the PIN mode instead and expect the entropy readout to be much lower.

• 16 characters, full symbol set: about 103 bits
• 16 characters, letters and numbers only: about 95 bits
• 16 numerals only: about 53 bits — a different thing entirely

How the passwords are generated

Every character comes from crypto.getRandomValues, the browser's cryptographically secure random number generator. Nothing here uses Math.random, which is seeded from the clock and produces sequences an attacker can reproduce — fine for shuffling a playlist, useless for a secret.

Picking a character from the alphabet uses rejection sampling rather than a modulo. Writing randomValue % alphabetLength is the obvious approach and it is subtly biased: because 2^32 is not divisible by most alphabet sizes, the first few characters of the set come up slightly more often than the rest. The bias is small, but it is a real reduction in the search space an attacker has to cover, so the generator discards values that would land in the uneven tail and draws again.

Generation happens entirely in your browser. No password is sent to a server, logged, or stored — there is nothing to breach, because nothing leaves the page. Closing the tab is all it takes to destroy every password you generated.

What the entropy figure actually measures

The bits shown under each password describe the generator, not the string it produced. That distinction matters more than it sounds.

Most strength meters score the output: they look for an uppercase letter, a digit, a symbol, and award points. By that measure "aA1!" scores four character classes and reads as strong, when it is four characters an attacker exhausts in microseconds. Scoring the settings instead gives the honest number — how large a space the password was drawn from, which is what an attacker actually has to search.

The formula is length multiplied by log2 of the alphabet size. Sixteen characters over the full 88-symbol set is 16 × log2(88), or about 103 bits. Drop symbols and the alphabet falls to 62, so the same length gives about 95 bits. Every character you add is worth more than every rule you satisfy.

The crack-time estimate assumes 100 billion guesses per second — a defensible figure for an offline attack on a fast hash with commodity GPUs — and halves the keyspace, because the average break lands midway through rather than at the end. Against a well-configured site that rate-limits logins, real attacks are far slower; the estimate deliberately assumes the attacker already has the password database.

Where to put the password once you have it

A generated password is only useful if you can retrieve it. The honest answer for most people is a password manager — it removes the need to remember anything except one master credential, and it fills passwords only on the domain they belong to, which quietly defeats most phishing.

If you are not going to use one, write the password down and keep the paper somewhere physical and private. A note in a drawer is a better outcome than a memorable password reused across accounts, because the realistic threat to your accounts is a credential-stuffing bot working through a leaked database, not a burglar reading your desk.

• Never reuse a password across sites — one breach then unlocks everything
• Turn on two-factor authentication where it is offered; it protects you even if the password does leak
• Change a password when a service discloses a breach, not on a fixed schedule — forced rotation pushes people toward predictable patterns
• Treat security questions as passwords too, and generate answers rather than using real ones

Frequently Asked Questions

Related free tools

• Memorable Password Generator (Passphrase)
• Password Generator, No Special Characters
• Random PIN Generator
• Strong Password Generator (Free, 2026)
• WiFi Password Generator
• QR Code Generator
• Business Card QR Code Generator (vCard)
• Email QR Code Generator
• Facebook QR Code Generator
• Instagram QR Code Generator
• Phone Number QR Code Generator (Free)
• Restaurant Menu QR Code Generator