CodeKitHubHow to Use
- Set the desired length with the slider (16+ recommended).
- Tick the character types you want — the more types, the stronger the password.
- Optionally exclude ambiguous characters if you'll type the password by hand.
- Click "Generate Password" (a new one also appears whenever you change an option).
- Click "Copy" and store it in a password manager.
Example
Input
Length: 16, all character types enabledOutput
K7#mQv9!xR2pWz@eAbout 105 bits of entropy — a modern GPU cluster would need longer than the age of the universe to brute-force it.
What Is This Tool?
A password generator creates random passwords that are far stronger than anything a human invents. People choose memorable patterns — names, dates, keyboard walks — and attackers know every one of those patterns. A random 16-character password from a full character set has around 100 bits of entropy, which is beyond any realistic brute-force attack.
This generator uses the Web Crypto API (the same secure randomness your operating system uses for encryption keys), guarantees at least one character from every set you select, and shows an entropy-based strength estimate so you can see the effect of each option.
NIST's password guideline SP 800-63B backs this up: it recommends supporting long passwords (at least up to 64 characters), checking candidates against known-breach lists, and dropping forced composition rules and scheduled resets — because length and randomness, not mandatory symbols, are what determine real strength.
Practical tips
- Length beats cleverness: a 20-character password of only lowercase+digits is stronger than a 10-character one using every symbol — watch the entropy meter as you drag the slider to see this yourself.
- Some sites cap length or ban symbols (banks are notorious). Match their rules with the checkboxes rather than editing the password by hand — hand edits concentrate predictability exactly where you added them.
- Generate a fresh password per site. The strength of any password is irrelevant once it's reused on a site that gets breached.
- For a password you must memorize (laptop login, password-manager master), length 20+ with no symbols is often easier to type and just as strong.
How strong is strong? A comparison
Concrete numbers for context: 8 characters mixed (~52 bits) falls to a modern GPU rig in hours if the site's hash leaks. 12 characters (~78 bits) holds for years. 16 characters (~105 bits) outlasts the hardware that would attack it. Online guessing is far slower than these offline numbers — rate limits cap attackers at thousands of tries, not trillions — but you don't control which breach happens, so generate for the offline case.
This is also why password managers changed the game: when nothing needs memorizing, every password can be 16+ random characters, and one breach stops mattering to your other accounts.
Password length vs. estimated crack time
Rough offline crack-time estimates for a password using a full character set (upper, lower, digits, symbols), assuming an attacker has stolen the password hash and is guessing with modern GPU hardware. Real times vary with the hashing algorithm the site uses, but the relationship between length and time holds.
| Length | Approx. entropy | Estimated offline crack time |
|---|---|---|
| 8 characters | ~52 bits | Hours to days |
| 10 characters | ~65 bits | Several months |
| 12 characters | ~78 bits | Centuries |
| 16 characters | ~105 bits | Longer than the age of the universe |
| 20 characters | ~131 bits | Effectively unbreakable with current computing |
Common use cases
- Setting up a new account on a site that enforces a specific password policy (minimum length, must include symbols) — set the matching options here rather than hand-editing a password to fit.
- Generating a batch of unique passwords when setting up multiple accounts or test users at once.
- Replacing a reused password after a breach notification, one unique password per affected account.
- Creating a Wi-Fi router or shared-device password that's strong but excludes ambiguous characters for anyone who'll type it from a printed card.
Why Use It?
Signing up for a new bank account and their password field demands 12+ characters with a symbol and a number? Set the options to match and generate one that clears the bar in one click.
Just got a breach notification email for a site you reused a password on? Generate a fresh, unique one for every account that shared it instead of guessing which ones are affected.
Setting up a shared Wi-Fi password guests will type from a printed card taped to the fridge? Turn on "exclude ambiguous characters" so nobody confuses a 1 with an l.
Provisioning twenty test accounts for a staging environment? Generate each password fresh instead of reusing "Test123!" twenty times.
Want to know if the password you just made is actually strong, not just long-looking? The entropy-based meter gives you a real number instead of a green bar that lights up for anything 8+ characters.
Setting a laptop login or password-manager master password you'll type by hand every day? Drop the symbols and push the length to 20+ — easier to type, just as strong.
Frequently Asked Questions
Is it safe to generate a password on a website?
On this one, yes — generation happens entirely in your browser using the Web Crypto API. No network request carries the password; you can even load the page, disconnect from the internet, and generate offline.
How long should my password be?
16 characters with mixed types is a strong default for important accounts. 12 is an acceptable minimum. Length matters more than complexity: a longer password beats a shorter one with more symbols.
What does the strength estimate mean?
It's entropy: the number of bits an attacker must guess. Each added bit doubles the guessing work. Under 45 bits is weak, 70+ is strong for online accounts, and 100+ resists even offline attacks on stolen password hashes.
Should I use the same generated password on several sites?
No. When one site is breached, attackers try the leaked password everywhere else. Generate a unique password per site and keep them in a password manager — that's what managers are for.
Why exclude ambiguous characters?
Characters like 0/O and 1/l/I look identical in many fonts. If you'll ever read the password aloud or type it from paper, excluding them prevents frustrating mistakes. It slightly reduces entropy, which the strength meter reflects honestly.
Where does the randomness actually come from?
The browser's Web Crypto API (crypto.getRandomValues), which pulls from your operating system's cryptographically secure random number generator — the same source used to generate TLS session keys. It is not JavaScript's Math.random(), which is fast but predictable and unsuitable for anything security-related.
My company's password policy requires a specific mix like "at least 2 numbers and 1 symbol" — will this work?
Yes. Enabling a character type guarantees at least one character from it appears in the result, so ticking numbers and symbols satisfies most "must include" rules. Policies requiring an exact count ("exactly 2 numbers") are rare; if you hit one, generate a few passwords and pick one that fits.
Does a longer password always beat a more complex one?
For brute-force resistance, yes — each extra character multiplies the search space far more than adding another character type does. A 20-character lowercase-only password (~94 bits) is stronger than a 10-character password using all four types (~65 bits).
How long should a generated password be?
If a site accepts it, 16 random characters from a full character set is beyond any realistic brute-force attack; 12 is a reasonable floor for ordinary accounts. If you must use a shorter password because of a site limit, compensate by enabling every character type — but prefer length whenever you have the choice, which is also the position of NIST SP 800-63B.