toolember
Pro
Generator

Password Generator

Generate secure random passwords instantly. Customize length, character types, and exclusions. Uses Web Crypto API for true cryptographic randomness, no data sent to servers.

Select at least one character type
16

How Password Security Works

Password entropy is a measure, in bits, of how unpredictable a password is. Each additional character exponentially increases the number of possible combinations an attacker must try.

NIST's Digital Identity Guidelines (SP 800-63B) set a minimum length of 8 characters for memorized secrets, but 16+ characters is a stronger, more practical baseline for the accounts this tool generates passwords for.

Weak (<60 bits)

Vulnerable to brute-force attacks. Avoid for important accounts.

Medium (60-80 bits)

Moderate protection. Acceptable for low-risk accounts.

Strong (80-100 bits)

Good protection. Resistant to brute-force for years.

Very Strong (100+ bits)

Excellent protection. Effectively uncrackable with current technology.

Cryptographic Security

This tool uses the Web Crypto API (crypto.getRandomValues), which provides the same level of randomness used by browsers for TLS/SSL connections. Unlike Math.random() which is predictable, the Web Crypto API draws from the operating system's cryptographically secure random number generator.

Character Sets Used in This Generator

Each character type you enable adds its full set to the pool the generator draws from. With all four types on, the pool has 88 possible characters per position, which is what drives the entropy score: more characters per position means more guesses an attacker needs to try.

Lowercase + Uppercase (52)

a-z and A-Z, 26 characters each. The largest contributor to the pool when both are enabled.

Numbers (10)

0-9. Adds the least entropy per character of any set, so numbers-only passwords need to be much longer to stay secure.

Symbols (26)

!@#$%^&*()_+-=[]{}|;:,.<>?: the biggest entropy boost per character, since it roughly doubles the pool size versus letters alone.

Exclusion filters

"Exclude Similar" removes 7 look-alike characters (i, l, 1, L, o, 0, O). "Exclude Ambiguous" removes 18 characters that render oddly in some fonts, such as brackets, quotes, and slashes.

Roughly how long would a password take to crack?

Entropy bits are abstract, so here is what they mean in practice. These figures assume an offline brute-force attack against an unsalted hash at 10 billion guesses per second, a commonly cited estimate for a well-resourced GPU rig. A properly salted, slow hash (bcrypt/Argon2, see the Hash Generator page) pushes these numbers up by many orders of magnitude, this table is meant to show why length and character variety matter, not to predict an exact real-world time.

LengthLetters + numbers onlyLetters + numbers + symbols
8 characters~3 hours~2 days
12 characters~5,100 years~340,000 years
16 characters~75 billion years~20 trillion years
20 characterslonger than the age of the universe, many times overlonger than the age of the universe, many times over

Common Use Cases

New account signup: Generate a 16-20 character password with all four character types enabled for any new online account, then let your password manager save it so you never type or remember it.
Router and Wi-Fi passwords: Set length to 20+ and turn off symbols if your router's admin panel has trouble with special characters. Longer, letter-and-number-only passwords are still very strong for Wi-Fi (WPA2/WPA3).
Master password for a password manager: Use maximum length (128) with all character types, since this single password protects every other credential you own.
Shared or verbally-communicated passwords: Enable "Exclude Similar" and "Exclude Ambiguous" so the password is unambiguous when read aloud or copied by hand, such as a guest Wi-Fi code posted on a whiteboard.
API keys and service tokens: Many services require alphanumeric-only secrets. Disable symbols and generate a long (24+ character) string for these cases.

Best practices: Generating a strong password is only half the job of staying secure.

  • Never reuse a password across two or more accounts, a breach on one site can then be replayed everywhere else.
  • Store passwords in a dedicated manager (Bitwarden, 1Password, Apple Keychain), not in browser autofill notes or plain text files.
  • Turn on two-factor authentication (2FA) wherever it is offered, it protects you even if a password ever leaks.
  • Rotate passwords immediately after any data breach notice for a service you use, not on a fixed schedule otherwise.

See our guide on how to create a strong password for more on why length beats complexity.

Frequently Asked Questions

How secure are these passwords?▾
Passwords are generated using the Web Crypto API, a cryptographically secure random number generator built into modern browsers. Each password is created from true randomness, not predictable patterns. The entropy score shows the theoretical strength, aim for 80+ bits for strong protection.
Should I save my passwords?▾
Never save passwords in plain text, browser notes, or unencrypted files. Use a dedicated password manager like Bitwarden, 1Password, or Apple Keychain. These tools encrypt your credentials and protect them with a master password or biometrics.
What makes a password strong?▾
A strong password has three key properties: length (at least 16 characters), variety (mix of uppercase, lowercase, numbers, and symbols), and randomness (no dictionary words or personal info). The strength meter rates your password based on these factors, aim for "Strong" or "Very Strong".
Why exclude similar characters?▾
Similar characters like i, l, 1, L, o, 0, O can be confusing when reading or typing passwords. Excluding them reduces errors in handwritten or verbally communicated passwords while maintaining security if you increase length slightly.
How long should my password be?▾
For most accounts, 16 characters is sufficient. For high-security accounts (banking, crypto, password managers), use 20+ characters. Length matters more than complexity, a 20-character password with just letters is stronger than a 12-character password with all character types.
Are passwords stored or sent anywhere?▾
No. All generation happens entirely in your browser using JavaScript. No data is sent to any server, stored, logged, or transmitted. The password exists only in memory and is discarded when you leave the page.
What password length do experts recommend?▾
NIST Special Publication 800-63B (Digital Identity Guidelines) requires a minimum of 8 characters for memorized secrets, but 16+ is ideal. Modern systems support up to 128 characters. For critical accounts, use passphrases (4+ random words) which are easier to remember and stronger than short complex passwords.
Should I use a random password or a passphrase like "correct-horse-battery-staple"?▾
Both can be strong if generated randomly. A random character password packs more entropy per character, so it is shorter for the same strength, but it is harder to memorize and type manually. A random passphrase (several unrelated dictionary words picked by a random generator, not chosen by a person) is longer but easier to recall and type on a phone keyboard. This tool generates character-based passwords; use it when you plan to store the result in a password manager rather than memorize it.

By Toolember · Updated September 2026