How to use the Password Generator
- 1
Choose Random password for maximum strength, or Passphrase for something easier to type and remember.
- 2
Drag the length slider (16 characters is a good starting point) or set the number of words.
- 3
Tick the character types you need, and exclude look-alikes if you will be reading the password aloud or typing it from paper.
- 4
Pick 1 password or a list of 5 or 10, then press Generate new until you get one you like.
- 5
Click Copy and paste it straight into the sign-up form or your password manager.
What actually makes a password strong
Attackers rarely guess passwords one by one on a login page. The real danger is a data breach: a site's password database leaks, and the attacker runs billions of guesses per second against it on graphics cards, offline, with no lockout. Against that, only two things matter. The password has to be long, and it has to be truly random.
Human-made passwords fail the second test. Password@123, Mumbai2024 and your pet's name followed by an exclamation mark all follow patterns that cracking tools try first, no matter how many symbol rules they satisfy. A password picked by a machine from a large character set has no pattern to exploit, so the attacker is stuck trying every combination.
That is also why reusing a password is so risky. When one small site is breached, attackers try the same email and password on Gmail, Amazon, Instagram and banking apps. One unique password per account stops a single leak from turning into a dozen.
Entropy in plain words
The strength meter on this page measures entropy in bits. Each bit doubles the number of guesses needed. The formula for a random password is simple: length × log2(number of possible characters). Lowercase letters alone give 26 options per character, about 4.7 bits each. With all four types selected this generator uses 87 characters, about 6.4 bits each, so a 16-character password has roughly 103 bits.
The crack-time estimate assumes an attacker making 10 billion guesses per second and finding the password, on average, after trying half the possibilities. Real speeds vary a lot. A site that stores passwords with a slow hash like bcrypt cuts that rate drastically, while a badly built site with fast hashes is closer to our figure. Treat the time as a comparison between options, not a promise.
| Password type | Entropy | Rating | Estimated crack time |
|---|---|---|---|
| 6-digit PIN | 20 bits | Very weak | Instantly |
| 8 lowercase letters | 38 bits | Weak | About 10 seconds |
| 8 characters, all four types | 52 bits | Fair | About 2 days |
| 12 letters and digits | 72 bits | Strong | About 5 thousand years |
| 16 characters, all four types | 103 bits | Very strong | Longer than the age of the universe |
| 7-word passphrase plus a digit | 66 bits | Strong | About 137 years |
Notice that length beats complexity. Going from 8 to 16 characters adds far more strength than any clever substitution of @ for a. These numbers only hold for randomly generated passwords; a word you chose yourself with the same length is much weaker.
Passphrases: when you need to remember it
Some passwords you cannot store in a manager: the password manager's own master password, your laptop login, the WiFi you dictate to guests. For these, a passphrase like raven-tulip-coal-orbit4-sail-pond-melon is easier to type and recall than X7#qL9!m, while still being random.
The passphrase mode picks words from a built-in list of 384 short, common English words using the same secure randomness. Each word adds about 8.6 bits. That is less per word than you might expect, because the list is short, so use at least seven words for an account that matters. The tool defaults to seven words plus a digit, which lands around 66 bits.
The words must be chosen by the generator, not by you. A sentence from a film or a song lyric is a famous phrase that is easy for cracking dictionaries to include.
How this generator creates randomness
Every character comes from crypto.getRandomValues, the browser's cryptographically secure random number generator, which is the same source used for encryption keys. Math.random, which many simple generators use, is not designed for security and should never be used for passwords.
Turning a random number into a character has a subtle trap called modulo bias: taking a random 32-bit number modulo 87 makes the first few characters very slightly more likely. This tool avoids that with rejection sampling, throwing away the rare random values that would cause unevenness and drawing again. When you ask for at least one character from each type, those guaranteed characters are shuffled into random positions so they are not always at the start.
Excluding look-alikes removes 0, O, o, l, 1 and I. That trims the pool from 87 to 81 characters, a tiny loss of strength that is worth it if you ever have to read a password off a sticker or say it over the phone.
Use a password manager and turn on 2FA
Nobody can remember fifty random passwords, and you should not try. A password manager such as Bitwarden, 1Password, or the one built into Google Chrome, Android and iPhone stores them encrypted and fills them in for you. You remember one strong passphrase; the manager remembers the rest. Generate a password here, paste it into the sign-up form, and save it in the manager at the same moment.
Then switch on two-factor authentication for email, banking, UPI-linked accounts and social media. With 2FA, a stolen password alone is not enough to log in. An authenticator app or a passkey is stronger than an SMS code, because SIM-swap fraud can redirect your texts, but SMS is still far better than nothing.
Finally, protect your email account above all others. Almost every other account can be reset through it, so it deserves your longest password and your strongest second factor.
Frequently asked questions
Is it safe to use an online password generator?
It is safe when the password is created on your device and never sent anywhere, which is how this tool works. Generation uses your browser's secure random generator, and the passwords exist only in the open tab. Close or refresh the page and they are gone.
How long should my password be?
Use at least 12 characters, and preferably 16 or more for important accounts like email and banking. Length adds strength faster than any other setting, and with a password manager a longer password costs you nothing extra.
Some websites reject symbols. What should I do?
Untick Symbols and increase the length by a few characters to make up for the smaller pool. A 20-character password of letters and digits is still very strong.
What is a good password example?
Something like vR8#tqM2!xLp9@Wd, generated at random, is a good example of the style. Never use a password you have seen published anywhere, including on this page, because attackers add published examples to their lists.
Is a passphrase better than a random password?
A random password packs more strength into fewer characters, so it is best for anything stored in a password manager. A passphrase is better when you must type or remember it yourself. Both are strong if they are generated randomly and long enough.
Should I change my passwords regularly?
Current guidance from security bodies such as NIST is to change a password when there is a reason, like a breach or suspected sharing, rather than on a fixed schedule. A long, unique password plus 2FA protects you better than frequent changes.
Last updated on November 9, 2026