Strong random password generator
Pick a length and the character types you want, and the generator builds a random password using your browser's cryptographic random source. It shows the entropy in bits and an estimated crack time. For an important account, use at least 16 mixed characters or a passphrase of 7 words.
- ✅ Free
- 🔒 No sign-up
- 📱 Works on mobile
- ⚡ Instant results
🔒 Everything runs in your browser. Your data and files never leave your device.
How the password is picked
Every character comes from crypto.getRandomValues, the cryptographic random generator built into your browser, not from Math.random, which is predictable. To draw a number from 0 to \( N - 1 \), the tool throws away values that would skew the result (the "modulo bias"), so every symbol has exactly the same chance of appearing.
When you check several types (lowercase, uppercase, numbers, symbols), the generator draws the whole password again until each type shows up. It never forces a type into a fixed position, so there is no pattern an attacker could guess.
\[ \text{entropy (bits)} = \text{length} \times \log_{2} (\text{alphabet size}) \]
A passphrase works the same way with words: entropy = number of words × log₂(list size). Our list has 250 words, or 8.0 bits per word, so you need more words than with a 7,776-word Diceware list (12.9 bits per word).
Length, entropy and crack time
Average crack time is half the search space (2bits−1) divided by guesses per second. The figures below assume an attacker who stole a database of fast hashes and can try 10 billion guesses per second. That is the case that matters, because a well-run site blocks online guessing long before.
| Password | Alphabet | Entropy | Average time at 10 billion/sec |
|---|---|---|---|
| 8 digits | 10 | 26.6 bits | under a second |
| 8 lowercase letters | 26 | 37.6 bits | 10 seconds |
| 8 letters + numbers | 62 | 47.6 bits | 3 hours |
| 10 letters + numbers | 62 | 59.5 bits | about 1 year |
| 12 characters, all types | 86 | 77.1 bits | about 259,000 years |
| 16 characters, all types | 86 | 102.8 bits | about 14 trillion years |
Each extra character multiplies the time by the size of the alphabet, so making a password longer helps more than making it fancier.
Password or passphrase?
A random 16-character password is ideal when a password manager remembers it for you. A passphrase (several random words) is easier to remember, which makes it the right pick for your password manager's master password, your laptop login or an encryption key you have to type by hand.
- Use a different password for every site, so one breach cannot open your other accounts.
- Turn on two-factor authentication wherever it is offered.
- Never build a password from a birthday, a pet's name or a dictionary word with swapped letters ("P@ssw0rd").
3 real-life examples
A bank account or your email
You set 16 characters with all four types. The alphabet has 86 symbols, so 16 × log₂(86) = 102.8 bits. Even a GPU cluster making a trillion guesses per second would need more than a hundred billion years on average.
Your password manager's master password
Switch to a passphrase with 7 words, hyphens and capital letters, for example Lantern-Tiger-Meadow-Violet-Anchor-Ribbon-Harbor. That is 7 × log₂(250) = 55.8 bits. Add a number at the end \( (+ 6.6 \, \text{bits}) \) or use 9 words to pass 70 bits.
A Wi-Fi password you type on a TV
Uncheck symbols and check "avoid look-alike characters". The alphabet shrinks to 56, and 14 characters give 14 × log₂(56) = 81.3 bits: strong, and easy to read without mixing up 0 and O.