Password Generator
Create a strong, random password with the length and character types you choose. Generated in your browser — nothing is sent or stored anywhere.
| Password Length | Character Set | Approx. Possible Combinations |
|---|---|---|
| 8 characters | Lowercase letters only (26 chars) | ≈2.1 × 10¹¹ |
| 8 characters | Upper+lower+numbers+symbols (88 chars) | ≈3.6 × 10¹⁵ |
| 12 characters | Upper+lower+numbers+symbols (88 chars) | ≈2.2 × 10²³ |
| 16 characters | Upper+lower+numbers+symbols (88 chars) | ≈1.3 × 10³¹ |
FAQ
What makes a password strong?
Length matters more than complexity — a longer password is exponentially harder to guess than a shorter one with more symbol variety. Mixing uppercase, lowercase, numbers, and symbols adds strength on top of that, which is why this tool lets you combine both length and character variety.
Is it safe to generate passwords online?
It's safe as long as the generation happens locally in your browser rather than being sent to a server — this tool works entirely client-side, so the password is never transmitted or logged anywhere.
How long should my password be?
Most current guidance recommends at least 12–16 characters for important accounts, longer where the site allows it. A password manager makes it practical to use long, unique, random passwords for every account without needing to remember them.
Should I reuse the same password across sites?
No — reusing passwords means a breach on one site can expose your accounts everywhere else that password is used. Generating a unique password per site (and storing them in a password manager) avoids that risk.
How many possible combinations does a password have?
It depends on both length and character variety — an 8-character password using only lowercase letters has about 2.1 × 10¹¹ possible combinations, while an 8-character password mixing all four character types jumps to about 3.6 × 10¹⁵. See the table above for longer lengths.
Does adding just one more character make a big difference?
Yes — each additional character multiplies the total number of combinations by the size of your character set, so the growth is exponential, not linear. Going from 12 to 16 characters (with all character types) increases combinations by roughly a million-fold.
What character types does this generator support?
Four types: uppercase letters (A–Z), lowercase letters (a–z), numbers (0–9), and symbols (!@#$%^&*()_+-=[]{}|;:,.<>?). You can toggle any combination of these on or off.
What is password entropy?
Entropy measures how unpredictable a password is, in bits. It equals the length times the base-2 logarithm of the size of the character set. A 16-character password using all four character types (88 characters) has about 103 bits.
Is a passphrase better than a random password?
Not necessarily stronger for the same length, but easier to remember. Four random words from a 7,776-word list give about 52 bits. A 16-character random password using all four character types gives about 103 bits, so use a password manager for those.
Why does my generated password sometimes have no symbol?
Each character is drawn independently from all the types you selected, so a given password may not include one of every type. If a site demands a symbol, number and capital letter, generate another or lengthen the password.
About this tool
This generator creates random passwords using your browser's cryptographically secure random number generator, not a predictable pseudo-random one. Choose a length and which character types to include, and generate as many as you need — nothing is saved or sent anywhere.
How password strength is measured
Strength is usually expressed as entropy in bits: the length multiplied by the base-2 logarithm of the number of possible characters. Each extra bit doubles the number of guesses an attacker needs. This generator draws every character independently from the set you select, using the browser's cryptographic random number generator, so these figures apply to its output.
| Character set | Size | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|---|
| Lowercase only | 26 | 38 | 56 | 75 | 94 |
| Upper and lower case | 52 | 46 | 68 | 91 | 114 |
| Upper, lower and numbers | 62 | 48 | 71 | 95 | 119 |
| All four types (this tool) | 88 | 52 | 78 | 103 | 129 |
Adding length helps far more than adding symbols. Going from 12 to 16 characters in the full set adds 26 bits, while adding symbols to a 12-character password using letters and numbers adds only 6 bits.
What that means in practice
| Character set | 8 characters | 12 characters | 16 characters |
|---|---|---|---|
| Lowercase only | 10 seconds | 55 days | 69 thousand years |
| Upper and lower case | 45 minutes | 619 years | 4.5 billion years |
| Upper, lower and numbers | 3.0 hours | 5.1 thousand years | 76 billion years |
| All four types (this tool) | 2.1 days | 342 thousand years | about 20 trillion years |
These times are illustrative: real attack speeds depend on how the website stores passwords, and well-designed sites make guessing far slower. The comparison is still useful, since a short password using only lowercase letters falls to a fast attack quickly and a random password of 16 or more characters is far out of reach.
Random passwords and passphrases
Random character strings are strong but hard to remember, which suits passwords stored in a password manager. For a password you must remember, a passphrase of random words can be easier. Four words chosen at random from a list of 7,776 words give about 52 bits, and six words give about 78 bits. The words must be picked by a random process, not chosen by you, since people pick predictable phrases.
Good password habits
- Use a different password for every account. If one site is breached, reused passwords let attackers try them elsewhere.
- Use a password manager to store long random passwords, so you only remember one strong master password.
- Turn on two-factor authentication, especially for email, banking and your password manager.
- Do not rely on rules about changing passwords regularly. Current guidance, such as NIST's, recommends changing a password when there is evidence of compromise and not on a fixed schedule.
- Check each site's limits. Some sites cap length or reject certain symbols. Untick the symbol option if a site refuses them and increase the length to compensate.
About this generator
Passwords are created in your browser with the Web Crypto API and are not sent anywhere or stored. Each character is chosen independently, so a password may occasionally not include every type you ticked. If a site requires at least one of each type, generate another one.