Strong Password Generator

Generate a strong random password using your browser's own cryptographic random source — the password is created on your device and never transmitted. Set the length and character set, and see the exact entropy in bits and an estimated crack time before you use it.

Last updated:

What makes a password strong

Strength is length times alphabet, and length does the heavy lifting. A 20-character password drawn from the full symbol set is around 129 bits of entropy — beyond the reach of any offline attack that will exist in your lifetime. The same character set at 8 characters is about 52 bits, which a GPU cluster works through in hours.

The rules most sites enforce — one capital, one digit, one symbol — barely move the number. They exist because they stop people choosing "password", not because they make a random password meaningfully harder. If you are generating rather than inventing, length is the only dial that matters much.

This page defaults to 20 characters with all four character sets enabled. That is deliberately longer than the 12 or 16 most tools default to, because the cost of extra length is zero when a password manager is doing the typing.

  • 12 characters, full symbol set: about 78 bits — adequate today, not for long
  • 16 characters: about 103 bits — comfortably beyond offline attack
  • 20 characters: about 129 bits — past the point where the number means anything practical

How the passwords are generated

Every character comes from crypto.getRandomValues, the browser's cryptographically secure random number generator. Nothing here uses Math.random, which is seeded from the clock and produces sequences an attacker can reproduce — fine for shuffling a playlist, useless for a secret.

Picking a character from the alphabet uses rejection sampling rather than a modulo. Writing randomValue % alphabetLength is the obvious approach and it is subtly biased: because 2^32 is not divisible by most alphabet sizes, the first few characters of the set come up slightly more often than the rest. The bias is small, but it is a real reduction in the search space an attacker has to cover, so the generator discards values that would land in the uneven tail and draws again.

Generation happens entirely in your browser. No password is sent to a server, logged, or stored — there is nothing to breach, because nothing leaves the page. Closing the tab is all it takes to destroy every password you generated.

What the entropy figure actually measures

The bits shown under each password describe the generator, not the string it produced. That distinction matters more than it sounds.

Most strength meters score the output: they look for an uppercase letter, a digit, a symbol, and award points. By that measure "aA1!" scores four character classes and reads as strong, when it is four characters an attacker exhausts in microseconds. Scoring the settings instead gives the honest number — how large a space the password was drawn from, which is what an attacker actually has to search.

The formula is length multiplied by log2 of the alphabet size. Sixteen characters over the full 88-symbol set is 16 × log2(88), or about 103 bits. Drop symbols and the alphabet falls to 62, so the same length gives about 95 bits. Every character you add is worth more than every rule you satisfy.

The crack-time estimate assumes 100 billion guesses per second — a defensible figure for an offline attack on a fast hash with commodity GPUs — and halves the keyspace, because the average break lands midway through rather than at the end. Against a well-configured site that rate-limits logins, real attacks are far slower; the estimate deliberately assumes the attacker already has the password database.

Where to put the password once you have it

A generated password is only useful if you can retrieve it. The honest answer for most people is a password manager — it removes the need to remember anything except one master credential, and it fills passwords only on the domain they belong to, which quietly defeats most phishing.

If you are not going to use one, write the password down and keep the paper somewhere physical and private. A note in a drawer is a better outcome than a memorable password reused across accounts, because the realistic threat to your accounts is a credential-stuffing bot working through a leaked database, not a burglar reading your desk.

  • Never reuse a password across sites — one breach then unlocks everything
  • Turn on two-factor authentication where it is offered; it protects you even if the password does leak
  • Change a password when a service discloses a breach, not on a fixed schedule — forced rotation pushes people toward predictable patterns
  • Treat security questions as passwords too, and generate answers rather than using real ones

Frequently Asked Questions

What counts as a strong password in 2026?

Sixteen or more random characters from a mixed alphabet, which puts you above roughly 100 bits of entropy. Length matters far more than composition rules: a 20-character password without symbols is stronger than a 12-character one with them. The strength meter on this page shows the actual bit count so you are not guessing.

Is this password generator safe to use?

Generation runs entirely in your browser using crypto.getRandomValues. No password is transmitted, logged or stored anywhere, and closing the tab destroys everything you generated. There is no account, so there is nothing for a breach to expose.

How long should a password be?

Twenty characters if a password manager will be typing it, since the length costs you nothing. Sixteen is a sensible floor for anything you type by hand. Below twelve you are relying on the site to rate-limit attackers, which you cannot verify from outside.

Do I need symbols in my password?

They help, but less than length does. Adding symbols takes the alphabet from 62 characters to 88, worth about half a bit per character. Adding four more characters is worth more. Some systems still reject symbols, which is why this page has a switch for turning them off.

Why does the generator avoid ambiguous characters?

The optional filter removes l, 1, I, O and 0 — characters that are hard to tell apart in many fonts. It costs a little entropy but prevents the failure where a password is read aloud, copied from a printout or dictated over the phone and typed back wrong.

How often should I change my password?

When a service you use discloses a breach, or when you suspect one. Rotating on a fixed schedule is counterproductive: people respond by making small predictable edits to a password they already had, which is weaker than leaving a strong random one in place.

What is the difference between a password and a passphrase?

A passphrase is several random words joined by a separator, designed to be typed and remembered by a human. A random password is denser per character but impractical to memorise. Use a passphrase where you must type it from memory — a device unlock or a password-manager master credential — and random characters everywhere else.

Can two people get the same generated password?

In practice, no. A 16-character password from the full set is one of roughly 10^31 possibilities. Even if every person alive generated one every second for the age of the universe, a collision would remain vanishingly unlikely.

Related free tools

More free utility tools