Quick answer: Password strength is measured in bits of entropy: length × log₂(size of the character set). Each extra character helps more than adding a symbol. A 16-character password using letters, digits and symbols (94 possible characters) has about 105 bits, and this generator makes passwords with your browser’s cryptographic random source.
Reused and guessable passwords are behind most account takeovers. A long random password is the simplest fix, but it only works if it is genuinely random. People are bad at making up random strings, and simple tricks like swapping “a” for “@” are well known to attackers.
This generator uses your browser's built-in cryptographic random number generator, the same source used for encryption keys. The password is created on your device, shown on screen, and never uploaded or stored.
What makes a password strong
Strength is measured in bits of entropy: how many guesses an attacker would need on average. It depends on the length and on the size of the character pool.
- Length matters most. Each extra character multiplies the number of possibilities.
- Use a different password for every account. Then one breach cannot unlock the others.
- Store them in a password manager, so you only have to remember one strong master password.
- Turn on two-factor authentication for email, banking and social accounts.
As a rough guide, under 40 bits is weak, 60 bits or more is strong for most uses, and 80 bits or more is very strong.
A worked example
Example. A 16-character password drawn from all four character types uses a pool of 88 characters, which gives about 16 × log2(88) = 103 bits of entropy. A 12-character password from the same pool has about 78 bits, and one made only of lowercase letters at 12 characters has about 56.
How length and character set add up
| Length | Lowercase only (26) | Letters and digits (62) | Letters, digits and symbols (94) |
|---|---|---|---|
| 8 | 38 bits | 48 bits | 52 bits |
| 12 | 56 bits | 71 bits | 79 bits |
| 16 | 75 bits | 95 bits | 105 bits |
| 20 | 94 bits | 119 bits | 131 bits |
Entropy = length × log₂(characters available). Every extra bit doubles the number of guesses an attacker needs, so 105 bits is far beyond what can be guessed. These figures apply to passwords chosen at random, not to words you pick yourself.
Common mistakes to avoid
- Using a short password with symbols instead of a long one. Length adds far more strength than swapping a letter for a symbol.
- Reusing one password on several sites. When one site is breached, attackers try the same password everywhere else.
- Storing passwords in a note or a browser tab. Use a password manager, and turn on two-factor authentication for important accounts.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created in your browser using the Web Crypto API. There is no server involved, nothing is saved, and the page works without sending your password over the network.
How long should my password be?
Use at least 16 characters for important accounts such as email and banking. For a password manager master password, consider a passphrase of four or more random words that you can remember.
Why skip look-alike characters?
Characters like I, l, 1, O and 0 are easy to misread. If you will ever type the password by hand, skipping them avoids mistakes.
Do symbols make a password stronger?
A little, because they enlarge the character pool. But length adds more strength than symbols. A 20-character password with letters and numbers beats a 10-character one with symbols. Some sites do not accept certain symbols, in which case turn them off.
People also search for this as: random password generator, strong password generator, secure password generator, password generator with symbols, how to create a strong password, passphrase generator.
Sources and further reading
- NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management
- MDN: Crypto.getRandomValues()
Formulas on this page are checked by automated tests against independent references. See how we test our tools.