🔐

Password Generators

Passwords people invent themselves follow patterns, and those patterns are exactly what cracking software tries first: a name, a date, a capital at the front and a digit at the end. A generated password has no such structure, which is why security guidance recommends one for any account that matters. The Password Generator builds a random string to your specification. You set the length and choose which character types to include, typically uppercase and lowercase letters, digits and symbols, then copy the result straight into the sign-up or password change form. Length does more for strength than complexity does, so if a site allows it, prefer a longer password over a short one stuffed with punctuation. Sixteen characters or more is a reasonable floor for email, banking and anything holding payment details. Generate a separate password for every account rather than adapting one across several. That way a breach at one site cannot be reused elsewhere, which is how most account takeovers actually happen. Since random strings are not memorable by design, store them in a password manager or, for the handful you must type from memory, use a long passphrase instead. The generator runs in your browser, so the password is created on your own device and never sent anywhere.

1 tools available

Showing 1–1 of 1

How the generator builds each password

The tool first assembles an alphabet from the sets you enabled. Uppercase adds 26 letters, lowercase another 26, digits add 10, and the symbol option adds 26 punctuation characters, giving a maximum pool of 88 distinct characters. Anything you type into the exclusion box is then removed from that pool, so barring characters such as the letter l, capital I and the digit 1 shrinks the alphabet before generation begins.

Characters are drawn with a cryptographically secure random integer function, not a general-purpose pseudo-random shuffle, so the output is not reproducible from a seed or a timestamp. To guarantee that a password satisfies composition rules, the generator reserves one character from each enabled set, fills the remaining positions from the full pool, merges the two lists, shuffles the whole thing and trims it to your requested length. That ordering matters: without the final shuffle the guaranteed characters would always appear at the start, which is exactly the kind of structure an attacker can exploit.

Worked example: entropy of a 16-character password

Set the length to 16 and enable all four character sets. The alphabet is 26 + 26 + 10 + 26 = 88 possible characters per position.

Password strength is measured in bits of entropy, calculated as length multiplied by the base-2 logarithm of the alphabet size. Here log2(88) is about 6.46, so entropy is 16 x 6.46, or roughly 103 bits. That corresponds to about 2^103 possible passwords, a search space far beyond brute force with current hardware.

Compare that with a 16-character password using lowercase letters only. The alphabet drops to 26, log2(26) is about 4.70, and entropy falls to 16 x 4.70, or roughly 75 bits. Still strong, but eight characters' worth of protection has been given away.

Now compare an 8-character password with all four sets enabled: 8 x 6.46 is about 52 bits, which offline cracking hardware can work through. The lesson is that length buys more security than complexity: going from 8 to 16 characters doubles the entropy, while adding symbols to a short password adds only a few bits.

Choosing settings and using the result safely

For everyday accounts, 16 characters with letters, digits and symbols is a sensible default. For anything protecting other credentials, such as a password manager master password or a root account, go to 24 characters or more. If a site rejects the password, the cause is almost always a symbol it refuses; switch symbols off and add four characters instead, which keeps the entropy roughly the same.

The exclusion box is genuinely useful when a password will be read aloud, typed on a games console, or dictated over the phone. Excluding O, 0, l, 1 and I removes the common misreadings, though it does slightly reduce the alphabet and so the entropy. Add a character or two of length to compensate.

Treat the strength label as a rough guide rather than a verdict: it scores length thresholds and the number of character sets in use, and cannot know whether you will reuse the password elsewhere. Reuse, not composition, is what turns one breached site into several compromised accounts. Store the result in a password manager rather than a note or spreadsheet, and never reuse a generated password across services.

Frequently Asked Questions

Sixteen characters is a good baseline for ordinary accounts, and 24 or more for anything that protects other credentials, such as a password manager or an email account used for resets. Length contributes more to strength than symbol variety: doubling the length doubles the bits of entropy, while adding punctuation to a short password gains only a few bits.
Each character is drawn using a cryptographically secure random integer function, which is designed to be unpredictable rather than seeded from a clock or a counter. That means the output cannot be reproduced by guessing when you generated it. The tool also guarantees at least one character from each set you enabled, then shuffles so those characters are not in fixed positions.
Yes. You can request up to 20 passwords in a single run, which is convenient when setting up several service accounts, database users or test logins in one sitting. Every password in the batch is generated independently from the same settings, so they share a length and character mix but no other relationship.
Exclude them only if the password will be typed manually, read aloud or entered on a device without a proper keyboard. Removing O, 0, l, 1 and I prevents transcription errors but shrinks the character pool, which slightly reduces entropy. Add one or two extra characters of length to offset the loss. For passwords you copy and paste, leave them in.
There are no accounts and no password history in this tool, so there is nothing to sign into and nothing to browse later. Each request produces fresh values that are shown once. Copy the password straight into a password manager, and generate a replacement if you ever produced one while sharing your screen or on a shared computer.