Random Password Generator

Supported options

Each mode draws from a different character set, and the size of that set is what determines how much entropy every character contributes.

Measuring strength in bits

Password strength is not a matter of looking complicated. It is the number of possibilities an attacker must work through, and for a password drawn at random it can be calculated exactly.

Each additional bit doubles the search space. The formula only holds for a password chosen at random: it says nothing about one a person invented, because human choices are not uniformly distributed and an attacker knows it.

What makes a password strong?

Not what most people think. Strength is not about looking complicated, and it is not about swapping letters for lookalike symbols. It comes down to one question: how many possibilities would an attacker have to work through to find yours?

That quantity is measured in bits of entropy. Each additional bit doubles the search space. A password drawn randomly from a 93-character set gives you about 6.5 bits per character:

• 8 characters— roughly 52 bits.
• 12 characters— roughly 78 bits.
• 16 characters— roughly 105 bits.
• 20 characters— roughly 131 bits.

Length dominates. Adding one character multiplies the work an attacker faces by 93; adding a symbol type to a short password barely moves the needle. If you take one thing from this page, make your passwords longer rather than more exotic.

Why "P@ssw0rd1" is not strong

Because attackers do not guess randomly. They run dictionaries of leaked passwords first, then apply the exact substitution rules people actually use: "a" becomes "@", "o" becomes zero, a digit and an exclamation mark go on the end. Those transformations are built into standard cracking tools, so a "complex-looking" dictionary word falls in well under a second.

A genuinely random 12-character password has no such shortcut. There is no pattern to exploit, so an attacker is forced to search the full space — and that is precisely why randomness matters more than apparent complexity.

Where the randomness comes from

Every character is drawn from crypto.getRandomValues(), the browser’s cryptographically secure generator. RFC 4086 sets out why that distinction matters: a general-purpose random function is built for speed and statistical spread, not unpredictability, and its internal state can often be reconstructed from a handful of outputs — which would let someone who saw one generated password derive others.

Every random decision here — which character, which word, the final shuffle — is drawn from your browser's cryptographically secure random number generator.

This distinction is not academic. General-purpose random functions in most programming languages are designed for speed and statistical spread, not unpredictability: their internal state can often be reconstructed after observing a few outputs, which would let someone who saw one generated password derive others. A cryptographic generator is built specifically to make that impossible.

Choosing a mode

Random characters

Maximum strength per character. Use this for anything stored in a password manager, where you never need to type or recall it — which should be almost everything.

Memorable words

Builds passwords from words with random casing and filler characters mixed in. Each character carries less entropy than a fully random one, so compensate with extra length. This mode is for the handful of passwords you genuinely have to type from memory: your device login, and the master password for your password manager.

Recommended lengths

• Ordinary website accounts— 16 characters, fully random, stored in a password manager.
• Email and banking— 20 or more. Your email account can reset everything else, which makes it the most valuable target you own.
• Password manager master password— long and memorable, since you must type it. Prioritize length over symbol variety.
• Wi-Fi— 20 or more. Captured handshakes can be attacked offline at enormous speed, with no rate limit to slow anyone down.
• API keys and service accounts— 32 or more. Nothing has to remember these, so there is no reason to economize.

Practical advice

• Never reuse a password.This matters more than length. When one site is breached, attackers try the same credentials everywhere else — an attack so common it has a name, credential stuffing.
• Use a password manager.It is the only realistic way to have a unique strong password per account. You memorise one; it remembers the rest.
• Turn on two-factor authentication.Even a perfect password can be phished. A second factor means a stolen password alone is not enough.
• Do not rotate passwords on a schedule.Forced expiry pushes people toward predictable variations. Change a password when there is reason to think it is exposed.
• Check for exposure.Breach notification services can tell you whether an address of yours has appeared in a known leak.