Password generator

How strong should your new password be?

A random password made on your device, with its strength in bits and nothing sent anywhere.

Password length

Your password

–

103 bits of strength, from a pool of 86 characters

How to use

Choose how long the password should be and which kinds of character it may use.
A new password appears at once. Press Generate for another one, or change a setting.
Copy it straight into your password manager or the sign-up form.
If you type it by hand, leave out the look-alike characters.

Entropy of random lowercase-only passwords

Length	Entropy (bits)
8	37.6
12	56.4
16	75.2
20	94
24	112.8

All 26 lowercase letters are allowed, including look-alikes. This does not rate passwords you choose yourself.

How it works

A strong password is one nobody can guess, and the best guesser-proof choice is one picked by chance. This tool draws every character at random from your device's secure random generator, so there is no pattern to find. It is made in your browser, shown only to you, and never sent, saved or put in the link.

Strength is counted in bits. If a password could be any one of N equally likely strings, its strength is log2(N) bits, and each extra bit doubles the number of guesses an attacker needs (Shannon, 1948). A password of L characters from a pool of P gives about P^L possibilities, so 16 characters from a pool of 86 gives about 100 bits. The tool counts the possibilities exactly, including the rule that every chosen kind of character appears at least once.

Length matters more than variety: adding a character multiplies the possibilities by the whole pool, while adding a kind of character only grows the pool a little. A random password is also only as safe as its use. Keep a different one for every account and store them in a password manager, because a strong password that is reused is only as safe as the weakest site.

Frequently asked questions

Is the password sent or stored anywhere?

No. It is made in your browser and disappears when you close or reload the page. It is never in the address, so sharing the link shares your settings, not a password.

How many bits are enough?

The more the better, since every extra bit doubles the guesses needed. The default of 16 characters gives about 100 bits, far more than anyone can try. A long random password costs you nothing when a password manager remembers it.

Why can the password start with a symbol or digit?

Because every position is chosen at random, with no fixed pattern. Forcing a letter first would make the passwords slightly easier to guess.

Why can't an AI assistant ask this tool for a password?

A password an assistant saw would no longer be private. The assistant can only ask how strong your settings are; you read the password on the page.

How long should a password be?

At least 12 characters for everyday accounts and 16 or more for email, banking and your password manager, with a different password for every account.

More in Web & developer

All 18 utilities in Web & developer