Password Generator to Create a Strong Password

How to Use the Password Generator

Set the length first, because length does more for security than any other option. Tick the character types you need and the tool makes a new password at once. Press Generate new password for another one, or raise the quantity to get up to 20 at a time.

• Length from 4 to 128 characters
• Uppercase, lowercase, numbers and symbols, with your own symbol list
• Options to skip lookalike characters and repeats

Digits show in blue and symbols in orange, which makes a long password easier to read and type. Copy the result with one click. The Copy all button saves a whole list when you make several. Everything updates as you type, so you can watch the strength rating change with each option.

What Makes a Strong Password

A strong password is long, random and used on one site only. Attackers do not guess the way people do. They run lists of leaked passwords first, then try common patterns such as a name followed by a year. A random string skips every one of those lists.

Length matters because each extra character multiplies the work for an attacker. Guidance such as NIST SP 800-63B favors length over forced rules. It also advises against changing a password on a schedule unless there is a sign of a breach.

Why Random Beats a Clever Password

People think they pick unpredictable passwords, but leaked lists show the same choices again and again. Swapping a for @ or o for 0 is a trick every cracking tool already knows. A password generator has no habits to exploit. Each character gets the same chance, so there is no pattern to find.

Some people prefer a passphrase made of random words. It is easier to type and works well for a master password you must remember. This password generator builds character strings instead, so use it for everything a manager will store. Both styles beat a short password built from a pet name and a birth year.

Password Strength by Length

The tool measures password strength in bits of entropy. Each bit doubles the number of guesses an attacker needs. The table uses all four character types and the default symbol list, which gives a pool of 87 characters.

The time column assumes an attacker who holds the stored hash and tests 10 billion guesses a second against a fast hash. Sites that use slow hashes or lock accounts are far harder to attack. Treat the numbers as a ranking and not as a promise.

Options That Change the Result

Leaving out lookalike characters removes O, 0, o, l, 1, I and the pipe symbol. That helps when you read a password aloud or copy it from paper. The pool shrinks a little, so add a few characters to make up the difference.

The option for at least one of every type is on by default, because many sites reject a password without a digit or a symbol. Some sites still refuse certain symbols, so edit the symbol list to match, for example by keeping only the exclamation mark and the at sign. No repeated characters lowers entropy slightly, so use it only when a site demands it.

How the Password Is Created

The tool asks the secure random source in your browser for numbers. If a number would favor some characters, the tool throws it away and draws again, so every character in the pool is equally likely. A final shuffle places the required characters at random spots.

It never calls Math.random, and it refuses to run if the browser has no secure source. Nothing you generate is saved or sent to a server. Close the tab and the password is gone.

Secure Password Habits

A secure password only helps when you use it once. Reusing it lets one breach open every account. Email deserves the longest password you own, because a reset link there opens everything else. Three habits cause most of the trouble.

• Adding a number to an old password when a site asks for a change
• Saving passwords in a notes file that anyone can open
• Using one password for both email and banking

Store each password in a password manager and turn on two step login where a site offers it. A manager also fills only the right site, which exposes lookalike phishing pages. Keep the master password long and unique.

What to Do After You Generate a Password

Paste the new password into the site first, then save it to your manager before you close the page. A password you never stored is a password you will have to reset. Turn on two step login right away, because a second factor protects you even when a password leaks. A strong password and a second factor together stop almost every automated attack.

Shared Accounts and Family Logins

Shared accounts need the same care. Give every family member or coworker a separate login where the service allows it. When sharing is unavoidable, send the strong password through the sharing feature of a manager instead of a chat message. Change it when someone leaves the group.

Length Rules on Real Sites

Some sites cap passwords at 12 or 16 characters. Others reject symbols. Use the maximum the site allows and set the character types to match. If a site truncates silently, log in once with the new password before you rely on it.

Create Your Next Strong Password

Choose a length of at least 16, generate a password and save it to your manager. The password generator costs nothing and needs no account. Come back whenever a new login needs a strong password. Bookmark this page so a fresh password generator is one click away.

Frequently asked questions

Related calculators

Other tools people use alongside the password generator.

• Hash Generator
• Random Number Generator
• Base64 Encoder / Decoder
• Slug Generator
• Case Converter
• Word Counter

Browse all calculators