Password Generator
Generate cryptographically random passwords with a chosen length and character set, plus an entropy estimate of how strong they actually are.
How to use this calculator
- 1Set the length — longer is stronger, and 16 or more is a reasonable default.
- 2Choose which character sets to include.
- 3Turn on "exclude ambiguous characters" if you might need to type the password by hand.
How the calculation works
Entropy (bits) = length × log₂(pool size)- pool size
- How many distinct characters could appear in each position
- length
- Number of characters in the password
Each additional character multiplies the number of possible passwords by the pool size, which is why entropy — a logarithmic measure — adds linearly with length.
Guaranteeing at least one character from each selected set slightly reduces true randomness in principle, but the effect on entropy is negligible for any reasonable length, and it avoids the practical annoyance of a 16-character password with no digits.
Worked example
A 16-character password using all four sets
- 1.The pool is 26 + 26 + 10 + 26 = 88 characters (using the symbol set above).
- 2.Entropy per character: log₂(88) ≈ 6.46 bits.
- 3.Total entropy: 16 × 6.46 ≈ 103.4 bits — well into "very strong".
Result: About 103 bits of entropy
What password entropy actually measures
Entropy is a measure, in bits, of how much genuine uncertainty a password has — in effect, how large the space of equally likely passwords is that an attacker would have to search before finding yours. It is not a vague marketing label; it is a specific, calculable quantity: each bit of entropy doubles the number of possible passwords, so a password with 40 bits of entropy is a million times harder to guess than one with 20 bits, all else equal. This tool computes it directly rather than estimating it from arbitrary complexity rules, so the number shown reflects the actual character pool and length you chose.
How the calculation works
Entropy in bits is length multiplied by log₂ of the pool size — the number of distinct characters that could appear in any position. A 10-character pool (digits only) gives log₂(10) ≈ 3.32 bits per character; adding uppercase, lowercase and symbols expands that pool and raises the per-character contribution accordingly. Because entropy adds linearly with length but the number of possible passwords grows exponentially, length dominates the total far more than character-set variety does — a longer password built from fewer symbol types can easily out-entropy a shorter, more "complex-looking" one.
Where a generated password actually gets used
The same tool serves several different situations, each with slightly different needs:
- New account signups — most sites enforce minimum complexity rules, but a randomly generated password comfortably clears any of them without you needing to hand-craft something that satisfies each site’s particular quirks.
- Wi-Fi and device passphrases — a router’s WPA2/WPA3 passphrase is typed rarely and stored by every device that joins the network, so it is a good candidate for a long, random string rather than something memorable.
- A password manager’s master password — this is usually the one password that still has to be memorised, since everything else can be stored — which is why it is often chosen with the "exclude ambiguous characters" option, to reduce typing errors when it does need to be entered by hand.
- API keys and service secrets — credentials shared between systems rather than typed by a person benefit from maximum length and the full symbol set, since there’s no readability trade-off to consider.
What length and randomness can’t fix
A strong password generator solves one part of a larger security picture, not all of it:
- Reuse defeats the whole point — a unique, high-entropy password loses almost all its value the moment it is reused on a second site — a breach of the weaker site hands over credentials that also unlock the stronger one.
- The server’s storage matters just as much — entropy calculations here assume whatever service you’re signing up for stores the password properly — hashed, salted, with a slow algorithm. A perfect password does nothing to protect you if the site itself stores passwords in plain text.
- Predictable "randomness" doesn’t count — substituting letters for look-alike symbols (P@ssw0rd) or padding a memorable word with digits feels more secure but barely moves the entropy needle, because attackers already build these substitutions into their guessing tools.
What this assumes, and where it stops
Assumptions
- A cryptographically secure random source is available in your browser, which every current browser provides.
Limitations
- Entropy estimates assume the password is used with a properly salted, slow hash (bcrypt, Argon2, scrypt) on the service storing it — a weakness in how a site stores passwords cannot be fixed by generating a stronger one.
- Crack-time estimates are illustrative. Real attack speed depends heavily on the hash algorithm the target system uses.
Common questions
How long should my password be?
At least 16 characters for anything important. Because entropy grows linearly with length but exponentially with the number of possible passwords, each additional character roughly doubles (for a large pool) the effort needed to guess it. Length is the single most effective lever you have.
Should I use a password manager instead of memorising these?
Yes, for anything beyond a handful of accounts. A password manager lets every account have a long, unique, random password like the ones generated here, without you needing to remember any of them — which is the only realistic way to avoid reusing passwords across sites.
Sources
- Password strength — US NIST Digital Identity Guidelines
Formula and content last reviewed on .
Results are estimates for information only, not professional advice.
Related calculators
Tools people commonly use alongside the password generator.