Password Generator

Turning Character Choices Into a Random, High-Entropy Password

A password generator creates a random string of characters from a chosen mix of letters, numbers, and symbols, strong enough that guessing it by brute force isn’t practical. Choose a length and which character types to include, and this calculator generates a password instantly — using your browser’s cryptographically secure random number source, not the weaker general-purpose randomness an ordinary “pick a random number” tool relies on.

Like this site’s Random Number Generator, the result here is deliberately not reproducible from the inputs alone — a shared link restores your settings (length and which character types you picked), not the password itself. Your generated password is never written into the URL, saved to this site’s calculation history, or sent anywhere; it only ever exists in your own browser, and running the generator again is supposed to give you something new.

The Formula

A password’s strength is measured in bits of entropy — how many yes/no guesses an attacker would need on average to find it by brute force:

$$\text{Entropy (bits)} = \vA{\text{Length}} \times \log_2(\vB{\text{Character Set Size}})$$

The character set size is the total count of every character type you selected — 26 for uppercase, 26 for lowercase, 10 for numbers, and around 25 common symbols — added together. Both a longer password and a wider mix of character types raise the entropy, but length matters more: doubling the character set size only adds 1 bit per character, while doubling the length doubles the bits outright.

Worked Example

A 12-character password using all four character types (uppercase, lowercase, numbers, and symbols):

1. Character set size: $26 + 26 + 10 + 25 = \vB{87}$ possible characters per position.
2. Entropy: $\vA{12} \times \log_2(\vB{87}) \approx 77.3 \text{ bits}$.
3. That falls in this calculator’s “Strong” band (60–79 bits) — a comfortable margin against an offline brute-force attempt with current hardware, though not quite the “Very Strong” band a longer password would reach.

Stretching the same four character types to 16 characters instead raises the entropy to about 103 bits — solidly into “Very Strong” territory, since the extra 4 characters compound the number of possible passwords far more than adding another character type would.

Key Factors to Consider

• A unique password for every account matters as much as a strong one. Reusing even a very strong password across multiple sites means a single data breach elsewhere can expose every account using that same password — a password manager makes generating and storing a unique strong password per account practical without needing to memorize each one.
• Length is the single biggest lever for password strength, more than character variety. Because entropy grows linearly with character-set size but exponentially with length, a longer password using fewer character types can still be stronger than a shorter password using every type — favoring length when a site’s own rules allow it is generally the better tradeoff.
• This calculator’s entropy estimate measures resistance to brute-force guessing, not every real-world attack. Phishing, credential stuffing (reusing a password leaked from another breach), and malware that captures keystrokes directly all bypass password strength entirely — a strong, unique password is one important layer of account security, not a complete defense on its own.
• Enabling two-factor authentication (2FA) wherever it’s offered adds a meaningful layer beyond password strength alone. Even a very strong password can still be exposed through a breach or phishing attempt — 2FA (a code from an app, a hardware key, etc.) means a leaked password alone usually isn’t enough to access an account.

Common Mistakes

• Shortening a password to make it easier to remember instead of using a password manager. Length is the biggest lever for entropy (see the worked example above) — trading length for memorability gives up real security for a convenience a password manager already solves without that tradeoff.
• Assuming a site’s minimum length requirement is a good target, not just a floor. A site requiring “at least 8 characters” is stating a minimum acceptable to its own systems, not a recommendation — generating well beyond that minimum costs nothing and meaningfully raises entropy.
• Reusing a strong generated password across multiple accounts. A single strong password used everywhere is only as safe as the least-secure site that stores it — one breach anywhere exposes every account sharing that password, no matter how high its entropy.
• Excluding symbols or numbers just to make a password easier to type on a phone. Removing a whole character type shrinks the character set (and therefore the entropy per character) more than most people expect — if typing convenience matters, adding a few characters of length offsets that loss more efficiently than dropping a character type.

Useful to Know

• Want to see exactly how entropy and cracking time scale with length and character types before generating? Password Strength Calculator evaluates any password’s strength without generating one.
• Need randomness for something other than a password? Random Number Generator generates random numbers in a chosen range — useful for anything from raffles to sampling, though it’s not cryptographically secure the way this generator is.
• Setting up a home network alongside better account security? IP Subnet Calculator works out subnet ranges and usable host addresses.