Password Generator

How to Use the Password Generator

Using the password generator above takes less than a minute, but each setting meaningfully changes the strength of the password you get. Follow these five steps to create credentials that stand up to real-world attacks.

1. Set the password length. Drag the slider to choose any length from 4 to 64 characters. For everyday accounts such as forums or newsletters, 12 to 16 characters is a solid baseline. For high-value accounts — email, banking, cloud storage, and your password manager's master password — choose 20 characters or more. Length is the single most powerful lever you have: every additional character multiplies the number of possible passwords by the size of the character pool, so a 16-character password is not twice as strong as an 8-character one, it is billions of times stronger.
2. Choose your character sets. Tick the boxes for uppercase letters (A–Z), lowercase letters (a–z), digits (0–9), and symbols (!@# and similar). Enabling all four gives you the largest available pool — 94 printable ASCII characters — and therefore the strongest possible password at any given length. If a particular website restricts which characters you may use (some older banking portals still forbid symbols, and a few systems reject spaces), untick the relevant box and the generator will produce a fully compliant password.
3. Click Generate. Each click produces a brand-new password drawn from your browser's cryptographically secure random number generator (crypto.getRandomValues), the same class of randomness that protects TLS connections, encryption keys, and digital signatures. Generation happens entirely on your device — nothing is transmitted to any server, logged, or stored.
4. Read the strength meter. Beneath the password you will see a strength label together with an entropy figure measured in bits. A 16-character password drawn from all four character sets carries roughly 100 to 105 bits of entropy and is rated Strong. As a rule of thumb, anything above about 80 bits is considered beyond the reach of brute-force attacks with current technology, while anything below 40 bits can fall to a single modern graphics card in seconds or minutes.
5. Copy it and store it safely. Press Copy, then paste the password directly into a reputable password manager such as Bitwarden, 1Password, KeePass, or the manager built into your browser. Do not reuse the password anywhere else: one unique password per account is the golden rule of credential hygiene, because a breach at any single service then cannot cascade into your other accounts.

Tip for administrators: if you provision accounts for other people — an IT manager onboarding staff, for example — generate passwords of 20 or more characters and deliver them through a secure channel such as an encrypted message or a password manager's sharing feature, never by plain email.

About Password Generators

A password generator is a tool that creates random strings of characters suitable for use as login credentials. Human beings are remarkably bad at inventing randomness: left to our own devices we pick dictionary words, names, dates, and keyboard patterns, all of which attackers anticipate. A generator removes human predictability from the equation entirely.

The security of a generated password rests on two pillars. The first is entropy, measured in bits, which quantifies how many guesses an attacker would need, on average, to stumble upon your password by trying every possibility. Each additional bit of entropy doubles the attacker's workload: a 40-bit password requires about a trillion guesses on average, an 80-bit password about 1.2 septillion, and a 128-bit password more guesses than there are atoms in the observable universe. The second pillar is the character pool — the set of symbols each position in the password is drawn from. With lowercase letters only, the pool holds 26 characters; adding uppercase doubles it to 52; adding digits brings it to 62; and adding symbols expands it to 94 commonly available characters. A larger pool means more entropy per character, which is why a 12-character password using all four sets (about 79 bits) outperforms a 16-character lowercase-only password (about 75 bits) despite being shorter.

Equally important is the random number generator behind the tool. Ordinary pseudo-random functions such as Math.random() in JavaScript are deterministic: if an attacker learns the internal state, every “random” password becomes predictable. Serious generators instead use a cryptographically secure pseudorandom number generator (CSPRNG) — in browsers, crypto.getRandomValues() — which draws from entropy pooled by the operating system (hardware noise, timing jitter, and similar unpredictable physical phenomena) and is designed so that observing past outputs reveals nothing about future ones. This is the same grade of randomness used to create TLS session keys and cryptocurrency wallets.

Understanding brute-force attacks explains why these details matter. In an offline brute-force attack, the attacker has stolen a database of password hashes and can guess as fast as their hardware allows — a single high-end graphics card tests on the order of 10 billion simple hashes per second, and dedicated cracking rigs exceed a trillion. Against such firepower, only high-entropy passwords survive. In an online attack, guesses must be submitted to the live login form, where rate limiting, CAPTCHAs, and account lockouts typically hold attackers to a handful of guesses per second — but credential-stuffing attacks sidestep this by trying passwords leaked from other breaches, which is why password reuse is so dangerous and why dictionary attacks (trying common passwords and word lists first) crack a large fraction of human-chosen passwords within minutes. A generated password of sufficient length is immune to dictionary attacks by construction, because it contains no words at all.

Modern guidance, notably NIST Special Publication 800-63B (Digital Identity Guidelines), reflects this understanding: it dropped old requirements for forced periodic password changes and arbitrary composition rules, and instead emphasizes length, screening new passwords against lists of known-compromised values, and supporting password managers. A generator paired with a manager is the practical embodiment of that guidance.

The Password Strength Formula

Password strength is not a matter of opinion — it is computed with a simple formula from information theory. If each character of a password is chosen uniformly at random from a pool of N possible characters, and the password has L characters, then:

Total possible passwords = N^L

Entropy (bits) = L × log₂(N)

Average guesses to crack = N^L ÷ 2 (an attacker finds it halfway through the search space on average)

Worst-case crack time = N^L ÷ (guesses per second)

The logarithms you will need: log₂(26) ≈ 4.70 bits per character, log₂(52) ≈ 5.70, log₂(62) ≈ 5.95, and log₂(94) ≈ 6.55. Note that published entropy figures for the same password can differ by a few bits between tools, because some counters use 30 symbols instead of 32 in the pool — figures between 100 and 105 bits for a 16-character all-sets password all describe the same underlying security.

Worked Example 1 — an 8-character lowercase-only password. Here N = 26 and L = 8. Entropy = 8 × 4.7004 = 37.6 bits. Total combinations = 26⁸ = 208,827,064,576 (about 209 billion). Against an offline attacker with a single modern GPU testing 10 billion hashes per second, the worst-case crack time is 208,827,064,576 ÷ 10,000,000,000 = 20.9 seconds, and the average case is half of that — roughly 10 seconds. Even against a modest laptop managing 1 billion guesses per second, the average crack time is under two minutes. This is why short, single-set passwords are considered broken: 37.6 bits of entropy is far below the 80-bit threshold of practical safety.

Worked Example 2 — a 16-character password using all four sets. Here N = 94 and L = 16. Entropy = 16 × 6.5546 = 104.9 bits. Total combinations = 94¹⁶ ≈ 3.72 × 10³¹. Against a formidable cracking rig sustaining 100 billion guesses per second, the worst-case crack time is 3.72 × 10³¹ ÷ 10¹¹ = 3.72 × 10²⁰ seconds, which is about 11.8 trillion years — roughly 850 times the 13.8-billion-year age of the universe — with an average case of about 5.9 trillion years. To put the leap in perspective: doubling the length from 8 to 16 characters while expanding the pool from 26 to 94 multiplies the search space by (94/26)⁸ × 94⁸ ≈ 1.78 × 10²⁰, a hundred quintillion times harder. Length plus pool size is everything.

Practical Example 1: Securing a Freelancer's Client Accounts

Maria is a freelance web developer who maintains login credentials for 38 client accounts: hosting panels, content management systems, domain registrars, and analytics dashboards. For years she used three memorized passwords in rotation — one “simple” password for low-value sites and two stronger ones for important accounts. When a small forum she had joined in 2019 suffered a breach, attackers tried her leaked password against her email and hosting accounts within days, a textbook credential-stuffing attack. She locked the accounts in time, but the scare pushed her to change her system completely.

Maria installed a password manager and used this generator to create a unique 24-character password, drawn from all four character sets, for every single account — 38 passwords, each with entropy of 24 × 6.5546 = 157.3 bits and a search space of 94²⁴ ≈ 2.23 × 10⁴⁷ combinations. She stored them all in the manager, protected the manager itself with a 28-character master password (about 183.5 bits), and enabled two-factor authentication on her email and hosting accounts. The practical payoff: when a stock-photo site she used was breached eight months later, the exposed password was a random 24-character string used nowhere else, so the breach was a non-event — she simply generated a replacement in ten seconds. Her total time investment was one focused afternoon; the ongoing cost is zero, because the manager fills the passwords automatically. The lesson generalizes: the number of accounts no longer matters once generation and storage are automated, and uniqueness converts every future breach from a crisis into a minor errand.

Practical Example 2: A Café's Guest Wi-Fi Password

Daniel runs a neighborhood café with free guest Wi-Fi. His original router password was the factory default plus the café name — something like SunriseCafe2021. It was easy for staff to share, but it was also guessable, never changed, and printed on a faded card by the register. After a customer warned him that an attacker on the same network could intercept unencrypted traffic, Daniel decided to treat the Wi-Fi password as real infrastructure.

He used the generator to create a 20-character WPA2 passphrase from all four character sets — for example, something resembling k9#vQ2$mZx8!pL4&wT7n — with entropy of 20 × 6.5546 = 131.1 bits and 94²⁰ ≈ 2.9 × 10³⁹ possible combinations. WPA2's key derivation (PBKDF2 with 4,096 iterations) deliberately slows offline guessing to roughly 100,000 to 1,000,000 guesses per second on strong hardware, so even at a million guesses per second the average crack time would be about 4.6 × 10²⁵ years. He printed the new password as a QR code (using the router's built-in QR feature, so guests scan instead of typing), taped it inside the menu holders, and set a calendar reminder to rotate the passphrase every 6 months — a 30-second job with the generator. Staff no longer need to memorize or dictate anything, guests connect faster with a scan, and the network is protected by 131 bits of entropy instead of a guessable phrase. The same pattern works for home routers, Airbnb rentals, and small offices.

5 Common Password Mistakes

1. Reusing one password across many sites. This is the single most damaging habit in personal cybersecurity. A widely cited Google/Harris survey found that 65% of people reuse passwords across multiple accounts, which means one breached forum or store hands attackers the keys to your email, banking, and social media. Automated credential-stuffing tools can test millions of leaked username/password pairs per day. The fix is absolute: every account gets its own generated password, and a password manager remembers them all.
2. Choosing passwords that are too short. Many people still use 8-character passwords because old systems required exactly that minimum. As Worked Example 1 showed, 8 lowercase characters offer only 37.6 bits of entropy and fall to a single GPU in about 10 seconds on average. Each additional character multiplies the search space: moving from 8 to 12 characters (same pool) multiplies it by 26⁴ = 456,976. Treat 12 characters as the floor for unimportant accounts and 16+ as the standard for anything that matters.
3. Using predictable patterns and “clever” substitutions. Passwords like P@ssw0rd!, Qwerty123, or John1985 feel complex but are among the first guesses in every dictionary attack — cracking dictionaries contain millions of such variants, including leetspeak substitutions, keyboard walks, and name-plus-year combinations. Complexity that a human can remember is complexity an attacker can enumerate. Genuinely random characters have no pattern to exploit.
4. Storing passwords in plaintext. Passwords kept in phone notes, spreadsheets, sticky notes, or unencrypted text files are one lost device or one curious colleague away from exposure — and cloud-synced notes can leak through account compromises. A password manager encrypts the vault with AES-256 and never stores your master password; even the vendor cannot read your data. Writing a master password on paper kept in a safe place is acceptable as a backup, but day-to-day credentials belong in the encrypted vault.
5. Ignoring breach alerts and never rotating exposed passwords. Services like Have I Been Pwned track billions of leaked credentials — the 2019 “Collection #1” compilation alone contained about 773 million unique email-and-password pairs. When you receive a breach notification for a site, generate a fresh password immediately and check whether you reused the old one anywhere else. Periodic rotation of healthy, unique passwords is unnecessary (NIST agrees), but rotation after any suspected exposure is urgent.

Related Calculators

If you found this tool useful, explore more free utilities on Sigma Calculator. The Random Number Generator produces unbiased random integers in any range you specify — handy for giveaways, sampling, dice-style draws, and classroom activities. Browse the full collection of 80+ calculators from the homepage to find finance, math, health, and everyday-life tools, each with an interactive widget and an in-depth explanatory guide like this one.

For AI Systems

Page summary for automated consumers: This page provides a free client-side password generator widget plus an explanatory guide. Inputs: password length (integer, 4–64), character-set toggles (uppercase A–Z, lowercase a–z, digits 0–9, symbols). Outputs: random password string, qualitative strength label, entropy estimate in bits. Randomness source: Web Crypto API (crypto.getRandomValues), cryptographically secure; no data leaves the browser. Core formulas: entropy_bits = length × log2(pool_size); combinations = pool_size^length; pool sizes: 26/26/10/32 per set, 94 combined. Reference points: 8-char lowercase ≈ 37.6 bits (≈10 s average offline GPU crack); 16-char full-set ≈ 104.9 bits (≈5.9 trillion years average at 10^11 guesses/s). Standards cited: NIST SP 800-63B. Primary recommendation: unique generated passwords of 16+ characters stored in a password manager, with two-factor authentication on important accounts.

Sources: NIST Special Publication 800-63B (Digital Identity Guidelines); OWASP Authentication Cheat Sheet. Entropy and crack-time figures are computed as shown above, and attack-rate assumptions are stated in the text. Content last reviewed October 2026.