Password Generator
How it works
Set the password length with the slider, anywhere from 4 to 64 characters, and pick which character types to include: uppercase, lowercase, numbers, and symbols. When symbols are enabled, you can edit the allowed special characters or pick one of the presets (Full, Safe, Minimal), so the password is accepted by sites that reject characters like <, >, " or /.
Behind the scenes the generator draws each character from the selected pool using window.crypto.getRandomValues, the browser's cryptographically secure random number generator. Math.random() is seeded from the current time and is predictable; getRandomValues is backed by a CSPRNG that is suitable for security-sensitive use. No network request is made, nothing is persisted, and closing the tab discards the value.
A good rule of thumb for password strength: every extra character adds roughly 6 bits of entropy when drawn from a 96-character pool (letters, digits and common symbols). A 12-character password from that pool carries about 78 bits of entropy, well beyond the reach of an online attacker and uncomfortable even for an offline attack with modern hardware. A 16-character password gives about 104 bits, which is the sweet spot for accounts you actually care about.
Frequently Asked Questions
Are the passwords truly random?
- Yes. The generator uses the Web Crypto API (crypto.getRandomValues), which returns values from a cryptographically secure pseudo-random number generator. It is the same class of RNG used to generate TLS session keys, and dramatically stronger than JavaScript's Math.random().
What is a strong password length?
- At least 14–16 characters for a new password, mixing upper-case, lower-case, digits and symbols. Below 12 characters the search space becomes attackable with consumer GPUs; above 16 characters the cost of a brute-force attack becomes astronomical even for a well-funded adversary.
Why would I customize the special characters?
- Because many sites silently reject certain symbols (commonly <, >, ", ', /, \, spaces, parentheses, or curly and square brackets) even when their rules page promises to accept them. Editing the allowed set gets you a password the site accepts on the first try, instead of burning attempts to figure out what's forbidden.
What do the Full, Safe, and Minimal presets mean?
- Full uses the complete symbol set !@#$%^&*()_+-=[]{}|;:,.<>?. Safe uses !@#$%*_-, a subset that virtually every banking, e-commerce and SaaS site accepts. Minimal uses just !@#$ for sites with the strictest password policies, most commonly enterprise portals and older systems.
How do I remember a 16-character random password?
- Don't. Use a password manager: 1Password, Bitwarden, Proton Pass, iCloud Keychain and Chrome's built-in manager all work well and are free or low-cost. Reserve your mental effort for the one strong master password that protects them.
Should I use a passphrase instead?
- Only where you have to type the password by hand: Wi-Fi, disk encryption, a master password. Passphrases of four to six random words are great there. For anything a password manager can fill in for you, a random 16-character string is shorter and equally strong.
Is this password generator safe to use?
- Yes. The password is generated entirely in your browser and is never sent to any server. You can confirm that by opening your browser's DevTools → Network tab: generating a password triggers no outbound request.
What is a strong password in 2026?
- Three things together: at least 14 characters, randomly generated rather than human-chosen, and never reused across sites. The third is the most important, because even a weak password used on one site is survivable if a breach of that site can't be used to log in anywhere else. Use a password manager so reuse is impossible.
Can this generate memorable passwords?
- No, and memorable random passwords are a contradiction: randomness is what makes them strong. The right approach is a password manager plus a passphrase for the master. If you absolutely need a memorable one (Wi-Fi at home, an encrypted USB), a 4-6 word passphrase is easier to type than a random string and just as secure. This tool focuses on character-based passwords; a separate passphrase generator is on the roadmap.
How often should I change my passwords?
- Only when a password has actually been compromised in a breach (check haveibeenpwned.com). Modern advice (NIST SP 800-63B, 2017+) reverses the old "change every 90 days" rule: forced periodic changes encouraged users to pick weaker, predictable variations (Password1 becomes Password2). A long, unique, never-leaked password protects you indefinitely.
Why won't my generated password work on this site?
- Most often the site rejects one of the symbol characters but doesn't tell you which. Switch to the "Safe" preset (!@#$%*_-), which works on virtually all sites, or "Minimal" (!@#$) for the strictest enterprise portals. If the password is rejected for length, lower the length to 16 or 12: some sites cap at 16-20 characters, which is silly but legal.
Password strength by length
Entropy and brute-force resistance for a fully-random password drawn from a 96-character pool (upper + lower + digits + symbols). Crack times assume an offline attack at 100 billion guesses per second (achievable with modern GPU clusters against a fast hash like SHA-256 or MD5).
| Length | Entropy (bits) | Unique combinations | Offline crack time |
|---|---|---|---|
| 6 | ~40 | ≈ 7.8 × 10¹¹ | ~8 seconds |
| 8 | ~53 | ≈ 7.2 × 10¹⁵ | ~20 hours |
| 10 | ~66 | ≈ 6.6 × 10¹⁹ | ~21 years |
| 12 | ~79 | ≈ 6.1 × 10²³ | ~193,000 years |
| 14 | ~92 | ≈ 5.6 × 10²⁷ | ~1.8 billion years |
| 16 | ~105 | ≈ 5.2 × 10³¹ | ~16 trillion years |
| 18 | ~118 | ≈ 4.8 × 10³⁵ | practically infinite |
| 20 | ~132 | ≈ 4.4 × 10³⁹ | practically infinite |
Numbers assume maximum-entropy random passwords. Human-chosen passwords lose ~30–50% of the theoretical entropy. For stored passwords use a slow hash (bcrypt, Argon2): crack times against those grow by 10⁴–10⁶× compared to SHA-256.