Password Generator
A 16 character password drawn from all 87 characters in this tool has about 103.1 bits of entropy.
How to use
- Set the length with the slider or type a number from 4 to 128. Longer is stronger, and 16 or more is a good default.
- Tick the character types you want. The password always includes at least one character from each type you tick.
- Tick Exclude look-alike characters if you will read or type the password by hand. Press Copy, or New password to draw another.
How it works
The password is built from your browser's cryptographic random generator. It first picks one character from each type you ticked, so the rules of most sites are met, then fills the remaining length from all ticked types together and shuffles the result so the guaranteed characters are not always in the same place. Every pick is unbiased.
The entropy shown is length multiplied by log2 of the number of possible characters. For example, 16 characters from a pool of 87 give about 103 bits. This is an estimate for random generation, so it applies to passwords made by a random generator and not to words or patterns a person chooses.
The strength label is a simple guide based on that estimate: under 40 bits is Weak, under 60 is Fair, under 80 is Good, and 80 or more is Strong.
Entropy by length and character types
| Length | Letters and numbers (62) | All types (87) |
|---|---|---|
| 8 | about 48 bits (Fair) | about 52 bits (Fair) |
| 12 | about 71 bits (Good) | about 77 bits (Good) |
| 16 | about 95 bits (Strong) | about 103 bits (Strong) |
| 20 | about 119 bits (Strong) | about 129 bits (Strong) |
FAQ
Is my password sent to a server or saved?
No. The password is created in your browser and is never sent to a server, stored, or logged. It disappears when you close or reload the page, and the share link never contains it.
How long should a password be?
For accounts, 16 characters with several character types is a strong choice. Length matters more than special characters, so for something you will type by hand, a longer password of letters and numbers also works well.
What does exclude look-alike characters remove?
It removes 0, O, o, 1, l, I and the vertical bar, which look alike in many fonts. This leaves a slightly smaller pool, so add a character or two if you want the same entropy.
Why does the password always have one of each type?
Many sites require at least one lowercase letter, capital, number and symbol. Guaranteeing one of each ticked type avoids a rejected password. The effect on strength is tiny.
Should I reuse a generated password?
No. Use a different password for every account and keep them in a password manager. A reused password is only as safe as the weakest site that stores it.