Strong Password Generator

Example Calculation

A 16-character password built from uppercase and lowercase letters, numbers and symbols draws each character from about 94 options. That is 94¹⁶, or roughly 3.7 x 10³¹ possible passwords, which is far beyond what a guessing attack can try.

Length matters more than tricks. Use a long, random password for every account, store them in a password manager, and turn on two-step verification.

How It Works

Weak and reused passwords are among the most common causes of hacked accounts. This password generator creates long, random passwords using your browser’s cryptographically secure random number generator (crypto.getRandomValues), the same source of randomness used by security software. Nothing is transmitted over the internet and nothing is saved.

Use the length slider to choose between 8 and 64 characters, and select which character types to include: uppercase letters, lowercase letters, numbers and symbols. The generator guarantees at least one character from each selected type, then fills the rest randomly from the combined pool and shuffles everything so the positions are unpredictable. An option to exclude look-alike characters such as O, 0, l, 1 and I is helpful if you need to read the password aloud or type it manually.

The strength meter estimates entropy in bits: the password length multiplied by the base-2 logarithm of the size of the character pool. As a rule of thumb, under 50 bits is weak, 50–70 is fair, 70–100 is strong and above 100 bits is very strong. Length matters more than complexity: each extra character multiplies the number of possibilities, which makes long passwords vastly harder to crack by brute force.

Best practices: use a unique password for every account, store them in a reputable password manager rather than a notes file or browser tab, turn on multi-factor authentication wherever it is offered, and never share passwords by email or text. Consider passphrases of four or more random words for passwords you must memorize. If a service reports a data breach, change that password immediately and anywhere else you used it.

Formula Explained

Entropy (bits) = length × log2(pool size)

For example, 16 characters from a 94-symbol pool: 16 × 6.55 ≈ 105 bits.

Assumptions and limits

• The password is generated in your browser and is never sent or stored. Copy it into a password manager right away.
• The strength labels (under 50 bits weak, 50 to 70 fair, 70 to 100 strong, over 100 very strong) are a common rule of thumb, not a standard. They assume the password is truly random and that an attacker knows how it was made.
• Government guidance asks for long, unique passwords: CISA recommends at least 16 characters, a different password for each account, and a password manager.
• A strong password does not protect an account that has been phished or reused. Turn on multi-factor authentication where you can.