-
A password is already made when the page opens. It uses the default settings: 16 characters and all four character types.
The tool shows one password at a time, and it does not keep old ones. Moving the slider or a box replaces the current password, so copy it first.
The Symbols box uses these 26 characters: !@#$%^&*()_+-=[]{}|;:,.<>?. With all four boxes ticked, the pool has 88 characters: 26 uppercase, 26 lowercase, 10 digits and 26 symbols. The tool picks one character from each ticked box, fills the rest from the whole pool, then shuffles the password so the forced characters can land anywhere. There is no option to leave out look-alike characters such as 0 and O or l and 1. That only matters if you have to type the password by hand, so copy and paste it when you can.
Password strength is often measured in bits of entropy. It counts how many guesses an attacker would need if they know exactly how the password was made. Each extra bit doubles the number of guesses. For a random password:
This formula is a quick estimate. Because the tool always puts in at least one of each ticked type, the real figure is slightly lower: about 103.0 bits for the default settings. With all four boxes ticked, the gap is about 1 bit at 8 characters, and it gets smaller as the password gets longer.
Compare that with 12 lowercase letters only: 12 × log2(26) = 12 × 4.70 = 56.4 bits. That is 47 bits less, which means about 140 trillion times fewer possible passwords.
The table uses the tool's real pool sizes and the same formula. Values are in bits.
| Boxes ticked | Pool | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|
| Numbers only | 10 | 26.6 | 39.9 | 53.2 | 66.4 |
| Lowercase only | 26 | 37.6 | 56.4 | 75.2 | 94.0 |
| Upper + lower | 52 | 45.6 | 68.4 | 91.2 | 114.0 |
| Upper + lower + numbers | 62 | 47.6 | 71.5 | 95.3 | 119.1 |
| All four | 88 | 51.7 | 77.5 | 103.4 | 129.2 |
Notice that length helps more than extra character types. 20 lowercase letters (94.0 bits) beat 12 characters with all four types (77.5 bits).
What those bits mean in time. Assume an attacker has stolen a password database and can test 10 billion guesses per second. An 8-character password from all four types has about 1.7 × 1015 options that contain every type, and this tool only makes those. Trying all of them takes about 2 days, and on average the right one turns up in about 1 day. At 16 characters, the average is about 17 trillion years at the same speed. Real speed depends on how the site stores passwords, so treat this as a comparison only.
The bar under the password uses the same formula as the table: length × log2(pool size). It shows the label and the number of bits. It looks at your settings, not at the password text, because the settings decide how many passwords are possible.
As explained above, the number is a little higher than the exact value when more than one box is ticked: about 0.3 bits too high at 16 characters with all four types, and about 1 bit at 8. We checked every length from 4 to 128 with every mix of boxes, and the gap never changes the label.
Every random choice uses a 32-bit number from your browser's crypto.getRandomValues(), which is built for security use. The tool never uses Math.random(). To turn the number into a character, it uses the remainder after dividing by the pool size. 232 does not divide evenly by most pool sizes, so the tool throws away numbers from the small uneven part at the top of the range and draws again. This is called rejection sampling. It means every character in a type is exactly equally likely. The same method is used for the final shuffle.
One side effect of the one-of-each rule: small types appear a bit more often overall. For example, at 8 characters with all four boxes ticked, about 18% of characters are digits instead of 11% (10 out of 88). Within each type, the choice is still even.
For most accounts, a random 16-character password from this tool is enough. After that, these habits matter more than extra length:
For the few passwords you must type from memory, like your password manager's master password or your computer login, a passphrase can be easier. It is several random words, such as tiger-candle-orbit-mango-velvet-river. This tool does not make passphrases. The words must be picked at random, for example with dice and a word list, not chosen by you. With the EFF long list of 7,776 words, each word adds 12.9 bits. Five words give 64.6 bits, and six words give 77.5 bits.
Summer2024! to Summer2025! is easy to guess for anyone who has seen the old one. Generate a completely new password.Yes. Every random choice uses your browser's crypto.getRandomValues function, which is designed for security use. It does not use Math.random. When a random number falls in the small uneven part at the top of its range, the tool throws it away and draws a new one. So within each character type, every character is exactly equally likely.
No. The password is made by JavaScript running in this page, and the tool does not send it anywhere. After the page has loaded, you can switch off your internet connection and the generator still works.
Yes. The tool first picks one random character from each ticked type. It fills the rest from all ticked types together, then shuffles the whole password. So every password has at least one character of each ticked type, and sites with rules like must contain a number accept it.
It shows bits of entropy: length times log2 of the pool size. Under 40 bits is Weak, 40 to 60 is Fair, 60 to 80 is Good, 80 to 100 is Strong, and 100 or more is Very strong. 16 lowercase letters give 75.2 bits (Good). The default 16 characters with all four types give 103.4 bits (Very strong).
Use 16 characters with all four types for most accounts. That gives 103.4 bits. If a site does not allow symbols, use 18 letters and numbers instead, which gives 107.2 bits. If a site has a maximum length, use the longest it allows.