Password Generator
Choose a length and the kinds of characters to use, then press Generate. You get a random password made in your browser, plus its pool size and entropy in bits. It is never saved, sent or put in a link.
Last updated November 4, 2026
4 to 128 characters
Result
Press Generate to create a password.
Strength estimate: Very strong. Pool of 86 characters, length 16, about 102.8 bits of entropy (16.0 × log2(86) = 102.8).
With the one-character-per-set rule the exact figure is 102.6 bits, the label uses it. The estimate assumes a truly random password and says nothing about reuse, phishing or data breaches. It is not a guarantee. The password is never saved, sent or placed in a link.
How the password and its entropy are worked out
entropy (bits) = length × log2(pool size)
Every character is its own draw from your browser’s secure random generator, the same Web Crypto source used for encryption keys. A draw is turned into a position in the pool of allowed characters. The few draws that would favor the first characters of the pool are thrown away and repeated, so every character has exactly the same chance.
When several kinds of character are selected, one character is first taken from each kind, the rest are drawn from the whole pool, and the lot is shuffled with the same secure source. That guarantees one of each chosen kind without fixing where they sit.
Entropy measures how many guesses a password would need if an attacker knew your settings. For a random password it is the length times log2 of the pool size. With the one-of-each rule a few strings are excluded, so the exact figure is very slightly lower. The page shows both numbers and bases the strength label on the lower one.
See how we calculate for the formulas, sources and review schedule behind every calculator.
Length beats complexity
Adding a character multiplies the possibilities by the pool size, while adding a character type only enlarges the pool a little. Going from lowercase letters (26 characters) to letters and digits (62) adds about 1.3 bits per character. Four more characters add far more, so extra length is the simplest improvement.
The default pool has 86 characters: 26 lowercase, 26 uppercase, 10 digits and 24 symbols. If a site refuses symbols, turn them off and add length instead.
Excluding look-alike characters
The capital O and zero, the capital I, lowercase l and one are easy to confuse when you read or type a password by hand. Turning on the exclusion option removes those five characters, which leaves a pool of 81 with every set on. The cost is about 0.09 bits per character.
What the strength label means
The label is a rule of thumb based only on entropy: under 40 bits is very weak, 40 to 59 weak, 60 to 79 fair, 80 to 99 strong and 100 or more very strong. It is a convention, not a standard or a guarantee, and it assumes the password was produced randomly, as this tool does.
Entropy says nothing about how a password is used. A very strong password is still weak if you reuse it on several sites, type it into a phishing page, store it in plain text or lose it in a data breach at the service. Use a different password for every account, keep them in a password manager and use two-factor sign-in where offered.
Where the password goes
The password is held in memory while it is shown and discarded when you generate another or leave. It is not written to the address bar, local storage or cookies and is not sent to any server. A shared or embedded link carries only the length and character settings. Copy password uses the clipboard only.
How to use the Password Generator
- Enter the length, from 4 to 128 characters. 16 or more is a good starting point.
- Tick the kinds of character to include and, if you will read it by eye, exclude look-alike characters.
- Press Generate, then read the pool size, the entropy in bits and the strength label under the password.
- Press Copy password and paste it into your password manager or the sign-up form. Press Generate again for a new one.
Worked example
A 16-character password using lowercase, uppercase, digits and symbols draws from a pool of 86 characters, so its entropy is 16 × log2(86) = 16 × 6.426 = 102.8 bits. Dropping the symbols leaves a pool of 62 and 95.3 bits. The table compares settings by their textbook figure, length × log2(pool size).
| Settings | Pool size | Entropy |
|---|---|---|
| 6 digits | 10 | 19.9 bits |
| 8 lowercase letters | 26 | 37.6 bits |
| 8 letters and digits | 62 | 47.6 bits |
| 12 letters and digits | 62 | 71.5 bits |
| 16 letters and digits | 62 | 95.3 bits |
| 16 with symbols | 86 | 102.8 bits |
| 20 with symbols | 86 | 128.5 bits |
Frequently asked questions
Is this password generator safe to use?
The password is created in your browser from its secure random generator and is never stored, sent or put in a link. You still need to keep it safe and not reuse it.
How long should my password be?
Use at least 12 characters for ordinary accounts and 16 or more for email, banking and your password manager. Longer is almost always better.
What does entropy in bits mean?
It is the log base 2 of the number of equally likely passwords for your settings. Each extra bit doubles the number of guesses an attacker would need.
Does a high strength label mean my account is safe?
No. The label only estimates guessing difficulty. It does not cover reuse, phishing, malware or a breach.
Why does a site reject my generated password?
Some sites cap the length or ban certain symbols. Turn symbols off or shorten the length to fit their rules, then add length elsewhere if possible.