Password Generator

What this calculator does

This tool generates strong, random passwords and estimates their strength based on length, character set, and entropy. It helps you create passwords that are resistant to brute-force attacks, dictionary attacks, and credential stuffing, while explaining the math behind what makes a password secure.

Weak passwords remain the leading cause of data breaches. "password123," "qwerty," and your pet's name with a birth year are trivially crackable—often in seconds. Yet most people still use simple, reused passwords because strong ones are hard to create and remember. This tool solves the creation problem; a password manager solves the memory problem.

Whether you are securing a bank account, email, server, or any online service, this generator produces cryptographically random passwords at the strength level you specify.

How to use it

1. Select the password length (12–64 characters; 16+ recommended).
2. Choose which character sets to include: uppercase, lowercase, digits, symbols.
3. Optionally exclude ambiguous characters (0/O, l/1/I) for easier manual entry.
4. Click Generate to create one or more random passwords.
5. Review the entropy score, estimated crack time, and strength rating.

Formulas used

• Entropy (bits): Entropy = Length × log₂(Character set size) Example: 16 characters from 95 printable ASCII characters → 16 × 6.57 = 105 bits of entropy.

• Character set sizes:

  • Lowercase only: 26
  • • Uppercase: 52
  • • Digits: 62
  • • Symbols (~33 common): 95

• Brute-force crack time: Combinations = Character set size ^ Length Time = Combinations / Guesses per second Example: 95^16 = 4.4 × 10^31 combinations. At 10 billion guesses/sec = 1.4 × 10^14 years.

• Entropy thresholds:

  • < 40 bits: Weak (crackable in minutes to hours)
  • 40–60 bits: Fair (may resist casual attacks)
  • 60–80 bits: Strong (resists most targeted attacks)
  • 80+ bits: Very strong (resists nation-state level attacks)

Examples

Example 1 — 12-character alphanumeric: Character set = 62 (a-z, A-Z, 0-9). Entropy = 12 × 5.95 = 71.4 bits. Example: kR7mNx2pLw9Q. Crack time at 10B guesses/sec ≈ 750 years.

Example 2 — 16-character full charset: Character set = 95. Entropy = 16 × 6.57 = 105 bits. Example: #vM8!nK@3pLx&w2R. Crack time ≈ trillions of years.

Example 3 — 20-character passphrase-style: 4 random words from a 7,776-word list (diceware). Entropy = 4 × 12.9 = 51.7 bits. Example: correct-horse-battery-staple. Easier to remember, still strong against most attacks. 5+ words recommended for high-security use.

Tips and common mistakes

• Length beats complexity. A 20-character lowercase password (94 bits) is stronger than an 8-character password with every character type (52 bits). Prioritize length.
• Use a password manager. The best password is one you do not need to remember. Tools like Bitwarden, 1Password, and KeePass generate, store, and autofill strong unique passwords for every site.
• Never reuse passwords. If one site is breached, attackers try the same email/password on every other service (credential stuffing). Unique passwords limit the blast radius.
• Passphrases are a valid alternative. Four or more random words (e.g. from the EFF Diceware list) create memorable passwords with good entropy. Avoid common phrases, song lyrics, or quotes.
• Two-factor authentication (2FA) is more important than password strength. Even a perfect password is useless if phished. Enable 2FA (preferably app-based TOTP or hardware key) on every critical account.
• Avoid personal information. Names, birthdays, addresses, and pet names are trivially guessable with social engineering. True randomness is the only reliable defense.