How to use
- Choose the length and character types to include.
- Click "Generate New" to create a password.
- Use the copy button to grab it instantly.
🎯 Use Cases
- Signing up for a new account — quickly generate a strong, unique password for each service
- Wi-Fi / router passwords — when you need an unpredictable random string
- Issuing temporary passwords — create one-time passwords to hand to teammates or customers
Example
Length: 16 Include: uppercase · lowercase · digits · symbols
8MX=3&TqUuG87X!* Strong (99 bit)
With all four character types enabled, the tool draws 16 characters from a 74-symbol pool (ambiguous characters like I, O, l, 1, 0 are excluded), yielding roughly 99 bits of entropy. Since generation is random, the actual output differs every time. This tool uses the browser's cryptographic API crypto.getRandomValues instead of Math.random() — ordinary random functions can have predictable seeds and aren't safe for security use, while this API draws from the OS-level random number generator and can't be predicted.
Estimated brute-force time by password length
| Length | Character set | Entropy | Time at 1 billion guesses/sec |
|---|---|---|---|
| 8 chars | lowercase only | ~38 bit | Minutes to hours |
| 8 chars | upper+lower+digits+symbols | ~52 bit | Tens of days |
| 12 chars | upper+lower+digits | ~71 bit | Thousands of years |
| 16 chars | upper+lower+digits+symbols | ~99 bit | Effectively infinite |
These figures are rough estimates for offline brute-forcing (an attacker who has stolen a password hash and tests locally at 1 billion attempts/sec). Real-world difficulty also depends on login rate limiting and the hashing algorithm used (bcrypt, for example, is deliberately much slower). Note that short passwords are more often compromised via credential stuffing (reusing leaked password lists) than pure brute force — which is why using a different password per service matters as much as length.
FAQ
- Is the generated password stored on a server?
- No. It's generated entirely in your browser using
crypto.getRandomValuesand never sent over the network. - How long should a password be to stay safe?
- In general, 12 characters or more is recommended, ideally 16+ with a mix of character types. As the table above shows, 16 characters puts brute-forcing well into "practically impossible" territory.
- Why does adding special characters make it safer?
- The more character types (charset size) a password draws from, the more possibilities a brute-force attack must try for the same length, growing the search space exponentially. Going from 26 characters (lowercase only) to 94 (full symbol set) makes an 8-character password's search space about 20,000× larger.
- Why are ambiguous characters (I, l, 1, 0, O) excluded?
- To reduce transcription errors when writing the password down or reading it aloud to someone. It slightly shrinks the character pool in exchange for fewer real-world mistakes.
🔑 Learn more: What Makes a Strong Password (and How to Generate One)
Length, character sets & entropy explained