16 characters with upper case, numbers and symbols
A set of 86 characters and about 103 bits of entropy: very strong.
Password generator
Why a random password beats a clever one
Most passwords that get cracked are short or follow a pattern, like a word with a number and a symbol on the end. Attackers try those patterns first. A password chosen at random, with every character equally likely, gives them nothing to exploit.
Strength is measured in bits of entropy: the length times the log of the number of characters available. Sixteen characters from lower case, upper case, digits and 24 symbols, a set of 86, gives about 103 bits. At 10 billion guesses a second, finding it would take far longer than the age of the universe. Dropping to 8 lower-case letters gives only 38 bits, which a fast attacker can guess in seconds.
This generator uses crypto.getRandomValues, the browser's secure random source, and picks each character without bias. It also makes sure every character type you ticked appears at least once, because some sites insist on it. The password is made on your device and never sent or stored.
Use a different password for every account, keep them in a password manager and turn on two-step sign-in where you can. If a site is breached, only that one password needs changing.
Sources
What this calculator does not account for
- Rules a site may set on allowed symbols or length.
- Keeping the password safe after you copy it.
- Two-step sign-in, which you should still turn on.
How this is calculated
Formula: Password strength
entropy (bits) =length × log₂(characters in the set)What the symbols mean
- lengthNumber of characters.
- characters in the set26 lower case, plus 26 upper case, 10 digits and 24 symbols if chosen.
Good to know
- Each extra bit doubles the guesses an attacker needs.
- Crack time = 2^bits ÷ 2 ÷ 10 billion guesses a second.
Read the full methodologyFound an error? Contact us
Worked examples
Each example is worked out by the same code as the calculator above.
8 lower-case letters only
About 38 bits: weak.
Embed this calculator
The frame shows the tool only.
<iframe src="/embed/password-generator" title="Password generator" width="100%" height="720" style="border:0;max-width:42rem" loading="lazy"></iframe>Questions
What makes a password strong?
Length and randomness. A random 16-character password from letters, digits and symbols has about 103 bits of entropy, far beyond what can be guessed.
Is it safe to use an online password generator?
Only if it runs in your browser and does not send the password anywhere. This one uses your browser's secure random generator and nothing leaves your device.
How long should a password be?
NIST guidance asks for at least 8 characters and encourages longer ones. For important accounts, 16 or more random characters, or a long passphrase, is a good choice.
Should I change my passwords often?
Not on a schedule. NIST advises changing a password when there is a sign it has been exposed, and using a different password for every site.
How do I remember random passwords?
Use a password manager. It stores one strong password per site, so you only need to remember the master password.