Random Password Generator
Create strong, random passwords with your choice of length and character types. Entropy is calculated for you.
—Strong · ~103.6 bits of entropy · pool of 89 characters
How to use the Random Password Generator
- Choose a length — 16 characters or more is recommended.
- Select which character types to include: uppercase, lowercase, numbers, symbols.
- Optionally exclude ambiguous characters like l, 1, I, O and 0.
- Click Generate and copy your new password into your password manager.
Examples
| Input | Output | Notes |
|---|---|---|
length 16, all character types | e.g. 7c$Rp2!kMvX9qL#w | ≈ 104 bits of entropy — very strong. |
length 12, letters + numbers only | e.g. h4Kp9mQr2Xtb | ≈ 71 bits — strong for most accounts. |
How strong is strong enough?
| Entropy | Rating | Guidance |
|---|---|---|
| < 36 bits | Weak | Avoid — crackable quickly |
| 36–59 bits | Reasonable | OK for low-value accounts |
| 60–127 bits | Strong | Recommended for important accounts |
| 128+ bits | Very strong | Future-proof; used for encryption keys |
Random password vs passphrase
A random string like 7c$Rp2!kMvX9qL#w is compact and high-entropy but hard to memorise. A passphrase of 4–5 random words is easier to remember and still strong. Use random strings for anything stored in a manager, passphrases for logins you type often.
Best practices
- Use a unique password for every account.
- Store passwords in a reputable password manager.
- Enable two-factor authentication where available.
- Change a password only if you suspect it was exposed.
Frequently asked questions
What makes a password strong?
Length and unpredictability. A random 16-character password mixing character types has enough entropy (around 100 bits) that it cannot be brute-forced. Reusing passwords or basing them on words is what makes accounts vulnerable.
What is password entropy?
Entropy, measured in bits, is the base-2 logarithm of the number of possible passwords your settings allow, multiplied by the length. Each extra bit doubles the guessing effort; 60+ bits is strong, 100+ bits is future-proof.
Is it safe to generate a password in the browser?
Yes. Generation uses crypto.getRandomValues locally and nothing is transmitted or logged. For maximum safety, generate on a device you trust and store the result in a password manager.
Why exclude ambiguous characters?
Characters like l, I, 1, O and 0 are easy to misread when a password is written down or dictated. Excluding them slightly reduces entropy but avoids login errors.
Should I use symbols?
Symbols increase entropy per character, but some sites reject certain symbols. If a site is picky, increase the length instead to reach the same strength.