Everyday Tools
Password Generator
Set the length, pick which character types to include, and generate a random password. Nothing is sent anywhere — the password is created in your browser.
Calculation inputs
Adjust the length and character types — a new password is generated as you change them.
Results
Your password
—
Strength
Very strong
Entropy
101 bits
- Length
- 16 characters
- Character pool size
- 81
- Uppercase included
- Yes
- Numbers included
- Yes
- Symbols included
- Yes
About this calculator
This tool creates a random password in your browser using your chosen length and mix of character types. It is built for anyone who needs a strong, hard-to-guess password for a new account without trying to invent one manually.
Generated in your browser only. Nothing is stored, logged, or transmitted.
How it works
- Characters are drawn at random from the selected pools using the browser's secure random generator
- Entropy (bits) = length × log2(number of possible characters)
- Look-alike characters (l, I, 1, 0, O) are left out to avoid transcription mistakes
Notes and assumptions
Longer beats more complex: adding characters raises strength faster than adding symbol types.
A password manager is the safest place to store what you generate here — this page keeps no record of it.
How it works in plain English
The generator builds a pool of allowed characters based on the options you select: lowercase letters are always included, and you can add uppercase letters, numbers, and symbols. Easily confused characters such as lowercase l, uppercase I, the number 1, and the letter O and number 0 are left out of the pool so a printed or handwritten password is not misread.
For each position in the password, the tool draws a random index from that pool using the browser's cryptographically secure random number generator rather than an ordinary pseudo-random function, which produces less predictable output.
Strength is reported as entropy, measured in bits, calculated from the password length and the size of the character pool used. More bits mean more possible combinations an attacker would need to try, which is the standard way security tools estimate how resistant a password is to guessing.
The formula
- Entropy (bits) = length x log2(pool size)
Worked example
Say you generate a 16-character password with uppercase, numbers, and symbols all enabled. The character pool comes to roughly 90 possible characters per position. Entropy is 16 x log2(90), and since log2(90) is about 6.49, that gives roughly 104 bits of entropy, which falls comfortably into the 'very strong' range. Dropping to 8 characters with only lowercase letters and numbers would shrink the pool to about 34 characters, yielding just 8 x log2(34), or roughly 41 bits, which is only moderate strength. Keeping the character pool the same but stretching the length back up to 12 characters instead would raise entropy to 12 x log2(34), or about 61 bits, moving it from moderate into the strong range without adding any new character types. This illustrates why simply typing a few extra characters often improves security more than switching in a handful of symbols.
How password entropy is generally interpreted
| Entropy | General strength |
|---|---|
| Under 40 bits | Weak — vulnerable to fast automated guessing |
| 40-59 bits | Moderate — acceptable for low-risk accounts |
| 60-89 bits | Strong — suitable for most accounts |
| 90+ bits | Very strong — resistant to brute-force attacks for the foreseeable future |
Ranges reflect commonly cited entropy guidance for password strength.
Frequently asked questions
Is the generated password sent to a server?
No. The password is created entirely in your browser using JavaScript, and the page does not transmit, log, or store what it generates. Closing or refreshing the page discards it, so you should copy or save it immediately.
Why does the password exclude certain characters?
Characters like lowercase l, uppercase I, the digit 1, and the letter O versus digit 0 look nearly identical in many fonts. Leaving them out avoids typing mistakes when a password is read off a screen or written down by hand.
Is a longer password always better than a more complex one?
Generally yes. Each extra character multiplies the number of possible combinations, while adding a new character type only multiplies it by a smaller factor. A longer password with fewer symbol types often beats a short one packed with special characters.
Should I reuse a strong generated password across sites?
No. Even a very strong password should be unique per account, because if one site's database is ever exposed, reused passwords let attackers access your other accounts. A password manager makes storing many unique passwords practical.
What entropy is considered safe for an important account?
Many security guides suggest aiming for at least 60 bits for everyday accounts and closer to 90 bits or more for highly sensitive accounts such as email or financial logins, since those bits determine how long a brute-force attack would realistically take.