Password Generator
Updated Free mock REST & WebSocket APIs
Generate a strong random password instantly. Choose the length and character sets, avoid look-alike characters, and see exactly how many bits of entropy you get and how long it would take to crack.
Pool: 89 characters · each adds 6.48 bits
| Online login, rate-limited · 10 guesses/s | 1.4 × 10^30 years |
| Offline, slow hash (bcrypt) on a GPU rig · 100k guesses/s | 1.4 × 10^26 years |
| Offline, fast hash (MD5/SHA-1) on a GPU cluster · 100 billion guesses/s | 139 quintillion years |
Generate many at once
🔒 Generated on your device with crypto.getRandomValues. Nothing is sent, logged or stored.
How to generate a strong password
- Set the length — 16 or more characters for important accounts.
- Choose character sets. Keep all four for the most entropy per character; drop symbols if a site rejects them.
- Optionally avoid look-alikes (I, l, 1, O, 0…) for passwords you'll read or type by hand.
- Copy the password straight into your password manager. Change any option for a fresh one, or use bulk mode for many.
How long should a password be?
Strength is measured in bits of entropy: length × log₂(pool size) for a truly random password. Each bit doubles the guesses needed.
| Character set | Pool | Bits per char | Length for 80 bits | For 128 bits |
|---|---|---|---|---|
| Digits only | 10 | 3.32 | 25 | 39 |
| Lowercase | 26 | 4.70 | 18 | 28 |
| Upper + lower + digits | 62 | 5.95 | 14 | 22 |
| All four sets (this tool) | 89 | 6.48 | 13 | 20 |
NIST SP 800-63B asks services to allow at least 64 characters and to stop forcing composition rules and periodic changes — length and randomness matter far more than a mandatory symbol.
What the crack-time estimate means
It's the average time to brute-force the password — half of all possibilities — at a given guessing speed. An online login with rate limiting allows maybe 10 guesses a second; an attacker who stole a database of bcrypt hashes might manage around 100,000 per second on a GPU rig, while unsalted MD5 or SHA-1 hashes fall to roughly 100 billion guesses per second on a GPU cluster. Estimates assume the password is random, which is exactly what this generator gives you; human-chosen passwords fall much faster to dictionary attacks.
Good password habits
- Use a different password for every site, stored in a password manager.
- Turn on two-factor authentication or passkeys wherever they're offered.
- For the one password you must remember (your password manager's), use a passphrase.
Related tools
Embed this tool on your site
Browse all embeddable tools →Free for blogs, HR, payroll and contractor sites: copy one snippet — the widget sizes itself and matches your colors.
Get the embed code
Frequently asked questions
Is it safe to generate a password on a website?
This one runs entirely in your browser: passwords are made on your device with crypto.getRandomValues and are never transmitted or stored. You can disconnect from the internet after the page loads and it still works.
What does “At least one of each” do to the entropy?
It removes the few passwords that miss a set, which lowers entropy very slightly. The bits shown account for this exactly, because the tool counts only qualifying passwords.
How strong is a 16-character password?
With all four character sets, 16 random characters give about 104 bits — far beyond any practical brute-force attack, even against fast hashes.
Which symbols are used?
! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > ? / ~ — common symbols accepted by most sites. Use “Exclude these characters” to drop any a site rejects.
Is a passphrase better than a password?
Not inherently — they're equally strong at equal entropy. Passphrases are easier to remember and type; random passwords are shorter. Use passphrases for passwords you have to memorize.
Your business here? Sponsor this tool from $16/week. See placements