How to use the password generator
- Choose Password for random characters or Passphrase for random words you can type from memory.
- For a password, set the Length and tick the Character types you want. Edit Symbols to use if a site rejects some, and tick Exclude look-alike characters if you will read it aloud or copy it by hand.
- For a passphrase, set the Number of words, the Separator, and whether to Capitalize each word or Add a number at the end.
- Press Generate new for another, then Copy and paste it into your password manager.
How strength is calculated
Entropy in bits is log2 of the number of passwords the generator could have made. For random characters that is length x log2(pool size). The tool also guarantees at least one character of every type you ticked, so it counts exactly how many strings meet that rule. Characters come from crypto.getRandomValues with rejection sampling, which avoids the slight bias of a plain remainder. Passphrase words come from the EFF long word list (7,776 words, minus four hyphenated entries), so each word adds log2(7,772), about 12.92 bits. The labels are Weak under 36 bits, Fair under 60, Good under 80, Strong under 100 and Very Strong from 100.
Worked example
With the starting settings (Password, Length 16, all four types, 28 symbols) the pool is 26 + 26 + 10 + 28 = 90 characters. Each character is worth log2(90) = 6.49 bits, so 16 characters give 103.9 bits. Requiring one of each type removes a few combinations, which brings the exact figure to 103.6, and the tool shows 104 bits and Very Strong. Switch to Passphrase with the default 6 words and the tool shows 78 bits (6 x 12.92 = 77.5) and Good, in a form like cabbage-uncover-snowy-dripping-pantry-lasso.
Limits and edge cases
- Length runs from 8 to 128. A value outside that range shows a message instead of a result, and unticking every type shows an error.
- Excluding look-alike characters shrinks the pool from 90 to 84 characters, which costs about 1.7 bits at length 16. Add a character or two to make up for it.
- Some sites cap length at 16 or 20 or ban certain symbols. Shorten the password or edit the symbol list rather than editing the result by hand, which lowers the entropy.
- Nothing is stored. Close the tab and the password is gone, so save it before you leave.
Frequently asked questions
How long should a password be?
NIST's 2025 guidance (SP 800-63B-4) requires at least 15 characters when a password is the only login factor and at least 8 when it is paired with multi-factor authentication. For a randomly generated password, 16 characters or more is a sound default.
Is a passphrase better than a random password?
Neither is stronger at the same entropy. Six random words give about 78 bits, close to a 12-character password of mixed characters, and are easier to type. Random characters are shorter for sites with length limits.
Is it safe to use an online password generator?
This one runs entirely in your browser and makes no network request when you generate, so the result never leaves your device. You can check by going offline first. Store the result in a password manager, not in a note or message.
Do I need symbols in my password?
Not for strength. One extra character adds about 6 bits, while adding symbols to the pool adds about half a bit per character, and NIST advises against forced composition rules. Keep symbols on when a site demands them, and turn them off if a site rejects them.
To test a password you already use, try the password strength checker. Need a unique ID rather than a secret? Use the UUID generator, or fingerprint text with the hash generator.
Sources: NIST SP 800-63B-4, Authentication and Authenticator Management (2025); EFF, Dice-Generated Passphrases (long word list, licensed CC BY 3.0 US); MDN, Crypto.getRandomValues().