Password Generator
Create strong random passwords with adjustable length and character sets, generated with your browser's cryptographic randomness and never transmitted.
Four extra letters beat the entire symbol set
A random password's strength is length × log₂(alphabet size), in bits. That makes the trade-off exact rather than a matter of taste:
| Alphabet | Per character | 8 | 12 | 16 |
|---|---|---|---|---|
| digits only | 3.32 bits | 27 | 40 | 53 |
| lowercase | 4.70 bits | 38 | 56 | 75 |
| upper and lower | 5.70 bits | 46 | 68 | 91 |
| alphanumeric | 5.95 bits | 48 | 71 | 95 |
| all printable ASCII | 6.55 bits | 52 | 79 | 105 |
Eight characters from all 94 printable symbols is 52.4 bits. Twelve characters of plain lowercase is 56.4. Four extra characters of the simplest possible alphabet beat every capital, digit and punctuation mark on the keyboard — because length enters linearly and alphabet size only logarithmically.
Worth stating the limit too, since “length always wins” would be overclaiming: 16 lowercase is 75.2 bits and 12 printable is 78.7, so the bigger alphabet does pull ahead once both are long. The point is that at the lengths people actually choose, four more characters is worth more than every symbol available.
| Password | Bits | To exhaust at 10¹¹ guesses a second |
|---|---|---|
| 8 printable characters | 52.4 | 8.5 hours |
| 4 random words | 51.7 | 5.1 hours |
| 12 lowercase characters | 56.4 | 6 days |
| 5 random words | 64.6 | 5 years |
| 16 lowercase characters | 75.2 | 6,909 years |
| 12 printable characters | 78.7 | 75,399 years |
And a complexity rule can make things worse
“At least 8 characters, including a capital and a digit” is meant to push people up from eight lowercase (37.6 bits) towards eight random printable (52.4). In practice people comply the cheapest way available: capitalise the first letter, append a digit.
| What the rule hopes for — 8 random printable | 52.4 bits |
| No rule at all — 8 random lowercase | 37.6 bits |
| Minimal compliance — Xxxxxxx1 | 31.5 bits |
The rule intended to buy 14.8 bits and instead lost 6.1 against simply asking for eight lowercase letters — because it converted two of the eight positions into ones an attacker can guess.
Which is why current NIST guidance dropped mandatory composition rules and raised the minimum length instead. A passphrase is the same argument from the other end: with a 7,776-word list, 5 random words is 64.6 bits — about ten random printable characters, and far easier to type.
How to use
- Set the length — longer matters more than anything else.
- Choose which character sets to include.
- Generate and copy the password.
- Store it in a password manager rather than trying to remember it.
Frequently asked questions
What actually makes a password strong?
Length, far more than complexity. Each additional character multiplies the search space, while adding a symbol to a short password barely helps. Current NIST guidance reflects this: it recommends allowing long passwords and dropping the composition rules that produced a generation of passwords like Password1!
Is the randomness here trustworthy?
It uses the Web Crypto API's cryptographically secure random generator, which is designed for exactly this purpose. It is not Math.random, which is fast, predictable from its outputs, and completely unsuitable for anything security-related.
Does the password get sent anywhere?
No. Generation happens entirely in your browser, and nothing is transmitted, logged or stored. You can disconnect from the network and it will still work — which is a reasonable thing to check with any tool that generates secrets.
Should I change my passwords regularly?
Not on a schedule, according to current guidance. Forced rotation drives people toward predictable variations — appending a number that increments each quarter — which weakens security rather than improving it. Change a password when there is reason to think it is exposed.
Is a random string better than a passphrase?
For strength per character, yes; for memorability, no. A random string is ideal for anything a password manager will hold. For the handful you must actually remember — the manager's own master password, your device login — a long passphrase of random words is easier and can be just as strong.
What is the single most important habit?
Never reusing a password. Credential stuffing — taking passwords from one breach and trying them everywhere else — is among the most common attacks precisely because reuse is so widespread. Unique passwords per site limit a breach to one account, and a password manager is what makes that practical.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.