Password Generator

How to use the password generator

1. Set the length, from 8 to 128 characters. 16 is a sensible default; use 20 or more for very important accounts.
2. Tick the character types you want: uppercase, lowercase, numbers and symbols. Untick symbols if a site rejects them.
3. Tick avoid look-alike characters if you will need to read or type the password by hand.
4. Choose how many passwords to make (up to 20) and press Generate.

Each result shows the strength rating, the entropy in bits, the size of the character pool and how long an average brute-force search would take at 10 billion guesses a second.

How the passwords are generated

Every character is chosen with crypto.getRandomValues, the browser’s cryptographically secure random number generator. To keep every character equally likely, the generator uses rejection sampling: it draws a random 32-bit number and throws it away if it falls in the small leftover range that would make some characters more common than others (the “modulo bias” that simple generators suffer from).

The generator then makes sure there is at least one character from each set you ticked, fills the rest from the full pool and shuffles the result with a Fisher–Yates shuffle, again using the secure random source. Nothing is sent to a server, so we never see your passwords.

The symbol set is ! # $ % & ( ) * + , - . / : ; < = > ? @ [ ] ^ _ { } ~ (27 symbols). It leaves out quotes, the backslash, the backtick, the vertical bar and the space, which some websites reject or which are easily confused.

Password entropy formula

For a password picked at random:

Entropy (bits) = length × log₂(pool size)

Possible combinations = pool size ^ length

Each bit doubles the number of guesses an attacker needs. Requiring at least one character from each set removes a tiny share of the possibilities, so the figure shown is a close upper estimate.

Password	Pool	Entropy	Average time to crack at 10¹⁰ guesses/s
8 digits	10	26.6 bits	less than a second
8 characters, all types	89	51.8 bits	2 days
12 characters, all types	89	77.7 bits	391 thousand years
16 lowercase letters	26	75.2 bits	69 thousand years
16 characters, all types	89	103.6 bits	longer than the age of the universe
20 characters, all types	89	129.5 bits	longer than the age of the universe

These times assume an attacker has stolen a database of fast password hashes and is guessing offline. Online logins are usually rate-limited, which makes guessing far slower, but you cannot rely on every site storing passwords well. Entropy only applies to randomly generated passwords. A password you invent, such as a name with a year and a “!”, is much weaker than its length suggests, because attackers try those patterns first.

Strength ratings used here

Entropy	Rating
Under 50 bits	Weak
50–69 bits	Fair
70–99 bits	Strong
100 bits or more	Very strong

What NIST recommends (SP 800-63B-4)

NIST’s Digital Identity Guidelines, revised in August 2025, changed several long-standing habits. For organisations that check passwords, the guidelines say:

• Passwords used as the only factor must be at least 15 characters; passwords used with multi-factor authentication must be at least 8.
• Sites should allow passwords of at least 64 characters and accept all printable ASCII characters, spaces and Unicode.
• Sites must not impose composition rules such as “one uppercase letter, one number and one symbol”.
• Sites must not force password changes on a schedule, only when there is evidence of compromise.
• New passwords must be checked against a blocklist of common, expected and breached passwords.
• Sites must allow password managers and autofill, and should allow pasting.

The message is to favour length over complexity and to make long, unique passwords easy to use.

Tips for using strong passwords

• Use a password manager. It can generate and remember a different password for every site, so a breach at one site does not expose the others.
• Never reuse passwords. Reuse is how most account takeovers happen after a data breach.
• Turn on multi-factor authentication for email, banking and anything that can reset other accounts.
• Use a passphrase for the few passwords you must remember, such as your password manager’s master password. Six random words from a 7,776-word list give 77.5 bits; four words give only 51.7.

For random numbers rather than passwords, such as raffle draws or dice rolls, use the random number generator.