Password Generator
Generated with your browser’s secure random source. Never sent anywhere.
How passwords are generated
Each character is picked at random from the character sets you choose, using the Web Crypto API (crypto.getRandomValues), the same source browsers use for encryption keys. Ordinary JavaScript randomness (Math.random) is fine for dice or coin flips but is not designed to be unpredictable, so it isn’t used here. The password is created on your device and is never sent to a server or stored.
The symbol set is !@#$%^&*()-_=+[]{}, which most websites accept. If a site rejects one of them, generate again or turn symbols off and add a few characters of length instead.
How strong is it?
Strength is usually measured in bits of entropy: length × log₂(number of possible characters). Each extra bit doubles the number of guesses an attacker needs.
| Character set | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|
| Lowercase only (26) | 38 bits 1.0 seconds | 56 bits 5.5 days | 75 bits 6,909 years | 94 bits 3.2 billion years |
| + uppercase (52) | 46 bits 4.5 minutes | 68 bits 62 years | 91 bits 453 million years | 114 bits 3,310,800 billion years |
| + numbers (62) | 48 bits 18 minutes | 71 bits 511 years | 95 bits 7.6 billion years | 119 bits 111,609,157 billion years |
| + symbols (80) | 51 bits 2.3 hours | 76 bits 10,888 years | 101 bits 446 billion years | 126 bits 18,266,938,940 billion years |
The guessing speed assumes an attacker has stolen a database of hashed passwords and is testing guesses offline on fast hardware, which is close to a worst case. Real speeds depend heavily on how the website stored the password. The pattern holds either way: length adds strength faster than extra character types do.
What matters more than strength
- Use a different password for every site. Reused passwords are the most common way accounts get taken over after another site is breached.
- Use a password manager to store them, so you only need to remember one strong master password.
- Turn on two-factor authentication wherever it’s offered.