Password Generator
A strong password is long, random and used for one account only. Humans are bad at randomness — we reach for names, dates and keyboard patterns that attackers try first — so this generator uses your browser’s cryptographically secure random number generator instead. Choose a length and the kinds of characters to allow, and it produces passwords that include at least one of each selected type, then shows how much entropy they have and how long a brute-force attack would take. Everything happens on your device: the passwords are never sent to a server, stored, or logged.
How to use the password generator
- Set the length. Sixteen characters is a sensible default for most accounts; go longer for anything valuable.
- Choose which character types to include. Some sites restrict symbols, so you can switch them off.
- Tick “avoid look-alike characters” if you will ever have to type the password by hand.
- Press Generate for a fresh one, then copy it straight into a password manager rather than writing it down.
Formula
Entropy (bits) = length × log₂(size of the character pool). Each extra bit doubles the number of guesses an attacker needs. With all four types selected the pool is 85 characters, so each character adds about 6.4 bits and a 16-character password has about 102 bits. The calculator assumes an attacker who can try 10 billion guesses a second offline against a fast hash, and that they find the password on average halfway through the space.
Worked examples
A 16-character password using everything
Using lower-case, upper-case, digits and symbols (a pool of 85 characters), a 16-character password has roughly 103 bits of entropy — well beyond any realistic brute-force attack.
A six-digit PIN
A six-digit numeric code has only 10⁶ possibilities, which is Weak (20 bits of entropy) — rated weak. PINs rely on rate-limiting (a lock-out after a few tries) rather than on entropy.
Length beats complexity
Eight characters drawn from all four types give about 51 bits; twelve lowercase letters alone give about 56 bits. Adding length is usually the cheapest way to add strength.
Choosing and keeping strong passwords
How strong is strong enough?
| Password type | Approx. entropy | Verdict |
|---|---|---|
| 6-digit PIN | 20 bits | Weak — relies on lock-out |
| 8 characters, all types | 51 bits | Fair |
| 12 characters, all types | 77 bits | Strong |
| 16 characters, all types | 103 bits | Very strong |
| 20 lowercase letters | 94 bits | Very strong — long and easy to type |
Practical habits
- One password per account, kept in a reputable password manager.
- Turn on two-factor authentication for email, banking and your password manager — preferably with an authenticator app or a security key rather than SMS.
- Check for breaches with a trusted breach-notification service and change any password that appears.
- Don’t reuse a generated password from a shared screen or chat; generate privately.
For a QR code that shares a Wi-Fi password with guests, see the QR code generator.
Common mistakes to avoid
- Reusing one password across sites. A breach at any one of them exposes all the others — use a unique password per account.
- Making “random-looking” passwords from a pattern (Summer2026!). Attackers’ guessing tools model exactly these habits.
- Storing passwords in a notes app, email or sticky note instead of a password manager.
- Skipping two-factor authentication on important accounts. A strong password plus a second factor beats either alone.
- Changing passwords on a schedule without a reason. Current guidance (NIST, the UK NCSC) favours long unique passwords and changing them only after a suspected compromise.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are produced in your browser with the Web Crypto random generator and are never transmitted, stored or logged. As with any tool, avoid using it on a device you do not trust.
How long should a password be?
At least 12 characters for ordinary accounts and 16 or more for important ones such as email, banking and your password manager. Length adds more strength than complexity.
Are symbols necessary?
Not necessarily. A long password with letters and digits can be strong. Symbols increase the pool size, which helps most when length is limited by a site.
What is password entropy?
A measure of unpredictability in bits: how many yes/no guesses an attacker would need in the worst case. 60 bits is decent for low-risk accounts and 80+ is very strong.
Should I use a password manager?
Yes — it lets you use a different long random password everywhere without memorising them. You only need to remember one strong master password.
Why does the generator avoid look-alike characters if I ask it to?
Letters like O and l are easily confused with 0 and 1 when typed from a screen or paper. Removing them slightly lowers entropy but avoids transcription mistakes.
Sources and further reading
- NIST Special Publication 800-63B — Digital identity guidelines (authentication and passwords)
- UK National Cyber Security Centre — Password guidance
Reviewed September 26, 2026 by the SolveCalcPro editorial team. Found a mistake? Tell us; see our editorial policy.