Weak passwords are the single most common reason accounts get hacked. Whether it is an email, a bank login, or a work VPN, a password like Password123 or Summer2024 falls to an automated guessing attack in seconds. This free password generator creates long, truly random passwords using your browser's cryptographic random source, and shows you exactly how strong each one is in bits of entropy and estimated offline crack time.
Adjust the length slider, toggle which character sets are allowed, and a fresh password appears instantly. Use it for every new account, and pair it with a password manager so you never have to memorize a single one of them.
How to Use
- Set the Password Length. NIST SP 800-63B requires at least 8 characters for user-chosen secrets; 12 is a strong default for most accounts, and 16 or more is worth it for banking, email, and anything tied to your identity.
- Toggle Uppercase (A-Z), Lowercase (a-z), Numbers (0-9), and Symbols on or off. Leaving all four on gives the largest possible pool (94 characters) and the highest entropy per character.
- Turn on Exclude Ambiguous if you will ever read the password aloud or type it on a phone keypad. It removes visually confusing characters such as
0andO,1,l, andI, and|— at the cost of a slightly smaller pool. - Read the result card. The top line is your generated password; below it, the card shows the entropy in bits, the size of the character pool, the total number of possible combinations, and a rough estimate of how long an offline GPU attacker would need to exhaust the keyspace.
- Click regenerate (or change any input) to roll a fresh password. Never reuse a password across sites; one breach on a small forum should never give an attacker access to your bank.
How Password Strength Is Measured
There are two ways a password gets cracked. The first is an online attack — the attacker types guesses at a login page, and lockouts and rate limits stop it almost immediately. The second, far more dangerous way is an offline attack: the attacker steals a leaked hash file and runs billions of guesses per second on rented GPU hardware. Every password you see in a data breach was broken this way.
Offline strength is measured in entropy, calculated as:
Entropy (bits) = length × log₂(pool size)
For example, a 12-character password drawn only from the 26 lowercase letters has a pool of 26, so its entropy is 12 × log₂(26) ≈ 56.4 bits. That sounds abstract, but 56 bits means the attacker must try about 2⁵⁶ ≈ 7.2 × 10¹⁶ combinations on average. At a fast offline rate of 10 billion guesses per second, that is roughly 83 days of continuous GPU time — uncomfortable for a website login, but not for a high-value target. Switching the same 12-character password to the full 94-character pool (upper + lower + digits + symbols) raises entropy to 12 × log₂(94) ≈ 78.7 bits, which pushes the crack time to thousands of years.
A 2024 Verizon breach report found that over 80% of hacking-related breaches still involve stolen or weak passwords, and the average cost of a single breach now exceeds $4.5 million. Spending ten seconds generating a 16-character random string is the cheapest insurance available.
Examples
Example 1 — The default 12-character, full-pool password. With all four character sets enabled (pool = 94) and length = 12, the generator produces something like k#R9$vL2!qZp. Entropy is about 78.7 bits, the pool holds 94 characters, the total combinations are 94¹² ≈ 4.7 × 10²³, and the estimated offline crack time at 10¹⁰ guesses per second is over 1,500 years. This is comfortably strong enough for email, social media, and most banking.
Example 2 — A lowercase-only 12-character password (the weak baseline). If uppercase, digits, and symbols are all turned off, the pool shrinks to 26 and entropy drops to about 56.4 bits — roughly 83 days of GPU time. A password manager passphrase of four random lowercase words (for example correcthorsebatterystaple) lands in a similar range but is far easier to type and remember.
Example 3 — A 16-character, maximum-strength password. Setting length to 16 with all four sets on yields entropy around 104.9 bits, with combinations near 94¹⁶ ≈ 3.5 × 10³¹. At 10¹⁰ guesses per second the crack time stretches into the trillions of years — beyond the lifespan of any known computer. Use this tier for your primary email, password-manager master account (or a 4–5 word passphrase), and any account holding more than a few thousand dollars.
Example 4 — A short 8-character password for a PIN-style lock. At 8 characters from the full 94-character pool, entropy is still about 52.4 bits — acceptable for a temporary device PIN, but below the 60-bit threshold security researchers recommend for anything long-lived.
FAQ
How is password entropy calculated?
Entropy equals the password length multiplied by the base-2 logarithm of the character pool size: entropy = length × log₂(pool). A larger pool or a longer password both increase entropy, but length helps more — adding two characters multiplies the keyspace by the pool size, while swapping in an extra character set only multiplies it once.
Is a 12-character password strong enough?
A 12-character password from the full 94-character pool (upper + lower + digits + symbols) has about 79 bits of entropy and is strong enough for nearly all consumer accounts. If the password uses only lowercase letters, the same 12 characters fall to roughly 56 bits — fine for a throwaway forum account, but weak for email or banking.
What is the best password length?
Use 12 characters as a minimum for everyday accounts, and 16 characters or more for email, banking, tax portals, and your password-manager master login. NIST SP 800-63B places no upper bound, and length is the single biggest lever you control; the generator accepts up to 128 characters for extreme use.
Do I really need symbols and numbers?
They help, but they are not the whole story. Symbols and digits raise the pool from 26 to 94 characters, which is a big jump. However, a 16-character lowercase passphrase (~75 bits) is often stronger than a forced 8-character password with a symbol, like Summer2024! — predictable patterns wreck the math because attackers try those patterns first.
Is this password generator safe to use?
Yes, when the page is served over HTTPS. Generation uses the browser's built-in cryptographic random source (the same API used by TLS), and passwords are computed locally in your browser — nothing is sent to a server, stored, or logged. Never type your real passwords into a random web page over plain HTTP.
Should I use a password manager instead?
A generator and a manager are partners, not competitors. The generator creates the secret; the manager stores it behind one master password. Without a manager, humans reuse the same memorable password across dozens of sites, which is exactly the habit that turns one breached forum into a breached bank.
What is the difference between a password and a passphrase?
A password is a short random string of characters; a passphrase is a sequence of random words, such as violet-tractor-banquet-72. Passphrases often reach 70–80 bits of entropy while remaining easy to type, read aloud, and remember. Use a passphrase for your password-manager master, and long random strings for everything else.
Disclaimer
This password generator is provided for informational purposes only and does not constitute security, legal, or compliance advice. Entropy and crack-time estimates are theoretical averages assuming an offline attacker trying 10 billion guesses per second against a properly hashed password; real-world strength depends on the site's hashing algorithm, rate limiting, breach history, and your own password hygiene. Always store generated passwords in a reputable password manager and enable multi-factor authentication on every important account.