Password Generator

How to generate a strong password

Set the length first, because it matters more than anything else. Keep numbers and symbols on unless a site rejects them. Click Generate, then copy the password straight into your password manager or the sign-up form. Generate a new one for every account; never reuse a password, however strong.

The default length is 20 characters. With letters, numbers and symbols that is about 128 bits of randomness, far beyond what any attacker can guess, even with a leaked password database and specialised hardware.

How long should a password be?

length   letters+digits (62)   + symbols (85)   typical use
12       ~71 bits              ~77 bits          minimum for most accounts
16       ~95 bits              ~103 bits         good default
20       ~119 bits             ~128 bits         password manager entries
32+      ~191 bits+            ~205 bits+        API keys, service accounts

In the generator, move the Length field before you touch the checkboxes. Each extra character multiplies the possibilities by the size of the whole alphabet, while switching Symbols on only raises every character from about 5.95 to 6.41 bits. That is why the table grows much faster down the rows than across the columns.

NIST's password guidelines (SP 800-63B, revised in 2025) require services to accept passwords of at least 15 characters when no second factor is used, and to allow at least 64. If a site limits you to 12 or 16 characters, use the maximum it allows.

Symbols, numbers and readable passwords

With symbols on, the generator draws from !@#$%^&*()-_=+[]{};:,.? as well as letters and digits. A few sites reject some symbols; if a password is refused, turn symbols off and increase the length by a few characters instead.

Readable mode removes characters that are easily confused: l, I and 1, and O, o and 0, plus i and L. Use it for passwords someone has to read aloud, type on a TV or a phone keypad, or copy from a printed card. The slightly smaller alphabet costs a little strength per character, so add two or three characters to compensate.

In numbers: readable mode leaves 54 characters without symbols and 77 with them. At the default length of 20 that is about 115 and 125 bits, against 119 and 128 with the full alphabet. With Numbers and Symbols both off, only the 52 letters remain, about 5.7 bits a character, and 20 of them still carry about 114 bits.

Random password or passphrase?

For accounts stored in a password manager, use random characters: you never type them, so shorter and denser is fine. For the few passwords you must remember, such as your computer login or the password manager itself, a passphrase of five or six random words is easier to recall and just as strong, provided the words are chosen at random, not by you.

Keeping generated passwords safe

Store passwords in a password manager, not in notes, spreadsheets or chat messages. Turn on two-factor authentication wherever it is offered; it protects the account even if the password leaks.

Change a password when there is a reason to, such as a breach notification or a password seen by someone else, not on a fixed schedule. Current NIST guidance advises against forced periodic changes because they lead to predictable patterns.

Check whether an existing password has appeared in a known breach with a service such as Have I Been Pwned, which uses a privacy-preserving lookup. Any password found there should be replaced, however complex it looks.

Is an online password generator safe?

It is safe when the password is created on your device and never transmitted. This generator runs entirely in JavaScript in your browser, uses crypto.getRandomValues() for randomness rather than predictable functions like Math.random(), and does not send, log or store what it generates. You can confirm that by opening your browser's network panel while you click Generate: no request is made.

Frequently asked questions

How do I generate a strong password?

Set a length of at least 16 characters, keep numbers and symbols enabled, and click Generate. Use a different generated password for every account and store it in a password manager.

Is a 12-character password strong enough?

A truly random 12-character password with letters, digits and symbols has about 77 bits of randomness, which is strong for most accounts. Longer is better, and 16 or more is a sensible default.

Are the generated passwords stored anywhere?

No. They are generated in your browser with a cryptographically secure random number generator and are never sent to a server or saved.

Should passwords include symbols?

Symbols add some strength, but length matters much more. If a site rejects symbols, turn them off and add a few extra characters instead.

What is readable mode?

It removes look-alike characters such as l, I, 1, O, o and 0, so the password can be read and typed without mistakes. Add a couple of characters to keep the same strength.

How often should I change my passwords?

Only when there is a reason, such as a breach or suspected exposure. Forced regular changes are no longer recommended by NIST because they encourage weak, predictable passwords.