🔒 Random Password Generator
Generate cryptographically strong, random passwords 100% locally in your browser.
What makes a password strong, and why length beats complexity
Password strength is measured in entropy: the number of bits of uncertainty an attacker faces. Each bit doubles the search space. The two things that produce entropy are the size of the character set and the length of the password, and length is by far the more powerful of the two because it enters as an exponent.
entropy (bits) = length × log2(character set size)
How the two factors compare
| Character set | Size | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|
| Lowercase only | 26 | 38 bits | 56 bits | 75 bits | 94 bits |
| Upper and lower | 52 | 46 bits | 68 bits | 91 bits | 114 bits |
| Alphanumeric | 62 | 48 bits | 71 bits | 95 bits | 119 bits |
| All printable ASCII | 95 | 53 bits | 79 bits | 105 bits | 131 bits |
Read across and then down. Adding symbols to an 8-character password takes it from 46 to 53 bits, a gain of 7. Adding four more characters takes it from 46 to 68, a gain of 22. Length wins, every time, and it is also easier to remember.
What the bits mean in practice
| Entropy | Average time to crack |
|---|---|
| 40 bits | under 1 minute |
| 50 bits | about 1.5 hours |
| 60 bits | about 2 months |
| 70 bits | about 180 years |
| 80 bits | about 190,000 years |
| 100 bits | longer than the age of the universe |
These figures assume an attacker has stolen a password database and is guessing offline against a fast hash. Against a well-designed site that rate-limits login attempts, even a weak password takes far longer to break online. The problem is that you never know which kind of site you are dealing with until after the breach.
Aim for at least 75 bits for ordinary accounts and over 100 for email, banking and your password manager's master password. Your email account is the master key to everything else, because password resets go there.
Passphrases
Four random words from a 7,776-word list, the standard Diceware approach, gives log₂(7776⁴) = 51.7 bits. Six words gives 77.5 bits, which is stronger than a 12-character random password and vastly easier to type on a phone. The critical word is random: words you chose yourself, or a phrase from a song, carry a tiny fraction of that entropy because the attacker's search space is your vocabulary and your taste, not the whole dictionary.
Rules that do not help
- Substituting characters. P@ssw0rd is in every cracking dictionary. Attackers apply these transformations automatically.
- Forced periodic changes. NIST dropped this recommendation in 2017, because it pushes people towards predictable increments like Summer2025 then Summer2026.
- Composition rules. Requiring one of each character type narrows the search space in practice, because almost everyone satisfies it the same way: capital at the front, digit and exclamation mark at the end.
- Security questions. Your mother's maiden name is not a secret. If forced to use them, answer with random strings stored in your password manager.
How this generator works
It uses the browser's crypto.getRandomValues, which is a cryptographically secure source, rather than Math.random, which is predictable and unsuitable for anything security-related. Generation happens entirely on your device. Nothing is transmitted, nothing is logged, and the page works with the network disconnected, which you can verify by turning off your connection and reloading.
A worked example
A 16-character password from the full printable ASCII set carries about 105 bits of entropy. At a hundred billion guesses a second, exhausting that space would take roughly 1.3 × 10¹³ years. The realistic attack is not brute force; it is phishing, reuse across sites, or a keylogger, which is why unique passwords and two-factor authentication matter more than adding a seventeenth character.
Frequently Asked Questions (FAQs)
How long should a password be?
At least 16 characters if it is random, or five to six random words as a passphrase. Below 12 characters, even a full character set does not give enough entropy against offline attacks on a stolen database.
Are passphrases really as strong as random passwords?
Yes, when the words are chosen randomly from a large list. Six random words from a 7,776-word list gives 77.5 bits, comfortably more than a 12-character random password. Words you picked yourself give far less, because your choices are predictable.
Should I change my passwords regularly?
Not on a schedule. NIST guidance since 2017 recommends against forced periodic changes, because they produce predictable patterns. Change a password immediately if a service reports a breach, or if you suspect it has been exposed.
Is it safe to use an online password generator?
It depends entirely on whether generation happens in your browser or on a server. This one runs locally using your browser's cryptographic generator and sends nothing. If a generator is not explicit about this, assume the worst, or use your password manager's built-in generator.
What is the single most important password habit?
Never reuse one. Credential stuffing, where attackers try credentials from one breach against every other service, is the most common account compromise by a wide margin. A unique password per site turns one breach into one problem instead of twenty.
Do I still need two-factor authentication with a strong password?
Yes. A strong password defends against guessing; it does nothing against phishing, a keylogger or a breach of the service itself. An authenticator app or a hardware key defends against all three and is the single largest security improvement most people can make.