# Random password generator

> A random password is as strong as its length times the bits each character adds. With uppercase, lowercase, digits and the 14 symbols turned on, the set has 76 characters and each one adds about 6.25 bits, so 16 characters give roughly 100 bits. This generator covers 4 to 128 characters and links to 16 presets for common lengths and rules.

## A starting point, not a one-size answer

There is no single right password. A Wi-Fi key that guests type on a television, a PIN for a phone, and a database password pasted into a config file all need different things. This page is the general tool: you choose the length and the character types yourself. If you already know what the password is for, one of the presets further down sets sensible defaults and explains the limits that apply to that case.

The generator has these controls:

- **Length** from 4 to 128 characters, starting at 16, with a slider and a number box that stay in sync.
- **Character types**: uppercase A–Z, lowercase a–z, digits 0–9, and symbols. The symbol set is exactly `! # $ % & * + - = ? @ ^ _ ~` (14 characters). Quotes, slashes, brackets, commas and spaces are left out because they cause the most trouble in forms, shells and config files.
- **Exclude look-alike characters** removes 0, O, o, 1, l, I and | so the result can be read off paper or a screen without guessing.
- **At least one of each selected type** is on by default, for the many sites that still insist on "one uppercase, one digit, one symbol".

## Make a password in five steps

1. Set the length with the slider or type a number between 4 and 128.
2. Turn character types on or off to match what the site or device accepts.
3. Switch on look-alike exclusion if you will ever read the password aloud or copy it by hand.
4. Press Generate and check the entropy figure under the result; the default 16 characters show 99.7 bits.
5. Copy the password straight into your password manager or the sign-up form, then press Generate again if a site rejects it.

## How the entropy figure is calculated

Entropy here means how many equally likely passwords the settings can produce, written as a power of two. If a password is one of 2⁸⁰ possibilities, an attacker who tries them in order needs 2⁷⁹ guesses on average. The formula is short:

**entropy in bits = length × log2(size of the character set)**

The character set grows with every type you allow:

| Allowed characters | Set size | Bits per character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase only | 26 | 4.70 |
| Lowercase and digits | 36 | 5.17 |
| Upper, lower and digits | 62 | 5.95 |
| All four, look-alikes removed | 70 | 6.13 |
| All four types | 76 | 6.25 |

Two details make the number honest. First, every character is picked uniformly, so the formula is exact rather than an estimate of human habits. Second, when "at least one of each" is on, some combinations can never appear (a password made only of lowercase letters, for instance), so the meter shows a slightly lower, conservative value: it counts only the passwords that contain every selected type. At 8 characters with all four types on, just 47.5% of random strings contain all four, which costs about 1.1 bits. At 20 characters the cost is about 0.1 bit.

Entropy only describes guessing. It cannot protect a password that is reused, typed into a phishing page, or stored in plain text by a careless site. Unique passwords in a password manager handle most of that.

## Presets by length

Each page below fixes the length (you can still change it), keeps all four character types on, and covers that length's entropy, guessing times and the standards or systems that name it.

| Preset | What that page covers |
|---|---|
| [8 characters](/password-generator/8-character/) | The old minimum, and why 50 bits falls in minutes to a fast-hash attack |
| [10 characters](/password-generator/10-character/) | What two extra characters buy, and systems that stop at 10 |
| [12 characters](/password-generator/12-character/) | The PCI DSS 4.0 minimum for payment systems |
| [14 characters](/password-generator/14-character/) | Windows' legacy policy ceiling and the LM hash cutoff |
| [15 characters](/password-generator/15-character/) | The NIST minimum when a password is the only factor |
| [16 characters](/password-generator/16-character/) | The length US cybersecurity guidance gives the public |
| [20 characters](/password-generator/20-character/) | Where brute force stops being the real question |
| [24 characters](/password-generator/24-character/) | Headroom for sites that restrict which characters you may use |
| [32 characters](/password-generator/32-character/) | Secrets for config files, and databases that cap at 30 or 32 |
| [64 characters](/password-generator/64-character/) | The longest length services are asked to accept, and Wi-Fi's hex key |

## Presets by rule

| Preset | Rule it follows |
|---|---|
| [Memorable](/password-generator/memorable/) | Three capitalized words, hyphens and two digits |
| [Wi-Fi](/password-generator/wifi/) | 20 letters and digits that are easy to enter with a remote |
| [PIN](/password-generator/pin/) | 6 random digits, adjustable from 4 to 12 |
| [No symbols](/password-generator/no-symbols/) | 16 letters and digits for sites that refuse punctuation |
| [Pronounceable](/password-generator/pronounceable/) | Six consonant–vowel pairs and two digits, easy to spell aloud |
| [Easy to type](/password-generator/easy-to-type/) | Lowercase and digits in hyphenated groups of four |

If you need something to remember rather than store, try the [passphrase generator](/passphrase-generator/) or roll your own words with [Diceware](/diceware/). To judge a password you already have, use the [password strength checker](/password-strength-checker/).

## How long is long enough?

It depends on how the password can be attacked. A website that locks an account after a handful of wrong tries is attacked online, a few guesses at a time. A leaked database, a captured Wi-Fi handshake or an encrypted file can be attacked offline, at billions of guesses per second when the hash is fast. Current guidance reflects that: NIST's 2025 revision wants 15 characters or more for a password used alone, and settles for 8 if another factor is required too. For anything that could be attacked offline, 16 or more random characters is a comfortable floor.

## Where the password lives

The password is created by JavaScript running in this tab. It is not sent to any server, not saved in the browser, and not kept in your history. Copying it puts it on your clipboard like any other text; some systems keep a clipboard history, so clear it if that matters on a shared computer. Reloading or closing the page discards everything.

## Under the hood

Random values come from `crypto.getRandomValues`, the browser's cryptographically secure generator. Turning a random byte into one of 76 characters needs care: 256 is not a multiple of 76, so a plain remainder would make the first 28 characters slightly more common. The generator uses rejection sampling instead. It throws away values that fall in the uneven tail and draws again, so each character has exactly the same chance. To confirm that generating sends nothing, open your browser's developer tools on this page; the [methodology page](/methodology/) walks through the check.

## FAQ


### Is a generated password better than one I make up?

Yes, for guessing attacks. People reuse patterns such as a capital first letter, a word, a year and an exclamation mark, and cracking tools try those patterns first. A generated password has no pattern to exploit, which is why its entropy can be calculated exactly.

### Why does the entropy drop when I turn on "at least one of each"?

Because the rule removes every combination that lacks a type. Fewer possible passwords means fewer bits. The loss is about a bit at 8 characters and nearly nothing past 16, so leave it on when a site demands mixed types.

### Does removing look-alike characters make the password weak?

It shrinks the set from 76 to 70 characters, about 0.12 bits less per character. A 16-character password drops from about 100 to about 98 bits. Add one character if you want to make up the difference.

### What is the longest password a site will accept?

There is no universal maximum. NIST says services should permit at least 64 characters, and older versions of the OWASP verification standard told developers to refuse anything over 128. Some systems cap far lower, so the presets mention the limits that apply to each length.

### Why did a site reject the password I generated?

Usually a site rule the generator could not know about: a length cap, a banned symbol, or a requirement such as "must start with a letter". Adjust the length or types and press Generate again; the next draw costs you nothing.

### Can I generate a password while offline?

Yes. Once the page has loaded, generating needs no connection, because everything runs on your device.

## Sources

- [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [OWASP ASVS 4.0.3, V2.1](https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x11-V2-Authentication.md)
- [CISA: Use strong passwords](https://www.cisa.gov/secure-our-world/use-strong-passwords)

Checked 2026-10-11.

Last updated: 2026-10-17