Password Generator

About this tool

A password's real strength comes down to one number: how many possible passwords an attacker would have to try, on average, before finding yours. That number is expressed as entropy, measured in bits — each additional bit of entropy doubles the number of guesses required. A password built from a wide character set and a reasonable length can have entropy well into the hundreds of bits, putting a brute-force guess entirely out of reach of any realistic computing power. A short password from a narrow character set — say, six lowercase letters — has barely over 28 bits of entropy, which modern hardware can exhaust in a fraction of a second.

This generator builds passwords from a pool of characters you control — uppercase letters, lowercase letters, numbers, and symbols — using your browser's cryptographically secure random number generator (the same API operating systems use for cryptographic key material), not Math.random(), which is not designed to be unpredictable in the way a password requires. Every character position is chosen independently and uniformly at random from whichever character sets you've enabled, which is what makes the entropy calculation below the password accurate: entropy is length × log₂(pool size), and that formula only holds when the selection process is genuinely uniform.

The strength meter translates that entropy figure into a practical read: under 40 bits is crackable quickly by consumer hardware, 40–60 bits is adequate for low-stakes accounts but not much more, 60–80 bits is solid for most personal accounts, and above 80 bits is comfortably strong for anything sensitive — a password manager's master password, an admin account, an API secret used as a password. The bar shown is a guide, not a guarantee: entropy measures resistance to brute-force guessing specifically, and doesn't account for a password being reused elsewhere, stored insecurely, or phished directly from you.

A practical note on character sets: excluding symbols or numbers to make a password "easier to type" measurably reduces its entropy for a given length — the fix is to increase the length instead, not to feel obligated to memorize the result at all. The strongest realistic setup for most people is a long, fully random password like the ones this tool generates, stored in a password manager, with two-factor authentication layered on top for anything that supports it. Nothing generated here is transmitted anywhere; the password exists only in your browser tab until you copy it.