How long should my password be?

For most online accounts, 16 characters using all four character sets (uppercase, lowercase, numbers, symbols) provides ~95 bits of entropy, which is computationally infeasible to brute-force. For high-value targets (email, banking, password manager master password), use 20–24 characters. For encryption keys or long-term secrets, 32+ characters. The strength meter on this tool shows the exact entropy and estimated crack time for your current settings.

What is password entropy and why does it matter?

Entropy measures the unpredictability of a password in bits. Each bit doubles the number of possible passwords. A password with 40 bits of entropy has 2^40 (~1 trillion) possibilities; 80 bits has 2^80 (~1.2 × 10^24). Modern GPUs can guess ~10^12 passwords per second, so 40-bit passwords crack in seconds, 60-bit in hours, 80-bit in centuries, and 100-bit+ is effectively uncrackable. Entropy depends on BOTH length AND character set size: a 16-char password using only lowercase (26 chars) has ~75 bits; the same 16 chars using all 94 printable ASCII has ~105 bits.

Should I use a password or a passphrase?

Passphrases (4–6 random words like "correct-horse-battery-staple") are easier to type and remember for the same entropy. A 4-word passphrase from a 7,776-word list (the EFF list) has ~51 bits of entropy. A 6-word passphrase has ~77 bits. For most people, a passphrase in a password manager is better than a random string they have to write down. Use the Secure Passphrase Generator tool (in the Security category) for passphrases. Use this Password Generator for cases where you’ll store the result in a password manager anyway.

Why are generated passwords better than ones I make up?

Humans are terrible at generating randomness. We bias toward common patterns (capital letter first, number last, real words with substitutions like "P@ssw0rd"). These patterns are in every cracking dictionary. A CSPRNG-generated password has uniform distribution across the entire character space, which means a cracker can’t do better than a blind brute-force — and brute-forcing 95+ bits is infeasible.

Can I use these passwords for important accounts (bank, email)?

Yes — the generator uses the same CSPRNG that banks and browsers use for TLS. However, ALWAYS store generated passwords in a reputable password manager (1Password, Bitwarden, KeePassXC) rather than reusing them or writing them on paper. Never reuse a password across accounts. Enable two-factor authentication on important accounts in addition to a strong password.

Security

Password Generator

Generate strong passwords with Web Crypto and a strength meter.

passwordgeneratecryptosecurerandom

Advertisement · horizontal

Loading tool…

Recommended tools

ProtonVPN

Privacy-first VPN with no-logs policy.

Affiliate links — we may earn a commission if you sign up.

About the Password Generator

The Password Generator creates cryptographically secure random passwords using the Web Crypto API (window.crypto.getRandomValues), not Math.random(). You control the length (4–128 characters), character sets (uppercase, lowercase, numbers, symbols), and whether to exclude ambiguous characters like l, 1, I, O, 0. Every password is generated locally in your browser and never transmitted, stored, or logged — making this safe for generating bank passwords, root account credentials, and API secrets. A real-time strength meter shows the entropy in bits and the estimated crack time so you can choose a length that matches your threat model.

Hand-written guide

Examples

Input

Length: 16, all character sets, exclude ambiguous

Output

K7$mP9!nQ2vR8xW3

Note: 16 chars = ~95 bits of entropy ≈ 10^28 years to brute-force at 10^12 guesses/sec.

Input

Length: 8, numbers + uppercase only

Output

7K3M9Q2P

Note: 8 chars = ~40 bits. Fine for low-value accounts; use 16+ for important ones.

Input

Length: 32, all sets

Output

a8$Km2!nQ7vR#9xW3pL5@jH8&fT0

Note: 32 chars = ~190 bits. Overkill for almost everything; useful for encryption keys.

How to use

1
Adjust the length slider (4–128 characters). The strength meter updates live as you drag.
2
Toggle the character sets you want to include: uppercase (A–Z), lowercase (a–z), numbers (0–9), and symbols (!@#$%^&*…).
3
Optionally enable "Exclude ambiguous characters" to remove look-alikes (l, 1, I, O, 0) — useful when passwords will be read aloud or handwritten.
4
Click Generate (or press the spacebar) to create a new password. The strength meter shows the entropy in bits and the estimated time to crack.
5
Click Copy to copy the password to your clipboard. The clipboard is automatically cleared after 30 seconds for safety (where supported by the browser).

Common use cases

Generating a strong master password for your password manager (use 20+ characters).
Creating unique passwords for each online account to prevent credential-stuffing attacks.
Generating API keys and shared secrets for service-to-service authentication.
Creating temporary passwords for new employees or account resets.
Generating a strong password for Wi-Fi networks (use 16+ characters; symbols are fine).

Tips

Aim for the "green" strength tier — that’s ~80+ bits of entropy, which is infeasible to brute-force.
Store every generated password in a password manager immediately. A strong password you forget is useless.
If a website limits password length (many cap at 20–32 chars), use the maximum they allow with all character sets enabled.
Some websites reject certain symbols (like < > or "). If a generated password is rejected, regenerate with symbols disabled or use a different site.
Never reuse a generated password. Generate a new one for every account — that’s the whole point of using a generator.

Frequently asked questions

Yes. It uses the Web Crypto API (window.crypto.getRandomValues), which is a cryptographically secure pseudo-random number generator (CSPRNG) provided by the browser. This is the same API used for TLS key generation. It is NOT Math.random(), which is predictable and unsafe for security. The generated password never leaves your browser — no server, no logging, no storage.

Explore more security tools

Browse the full collection of security tools on the hub, or jump back to all categories.

All Security tools All categories

Advertisement · footer