Password generator
Every password here is created in your browser and never leaves it. A generator that talks to a server is a generator that knows what it made.
What this generator does
Two things decide whether a password holds: how many characters it has and how many different characters could have been in each position. Multiply those out and you get a number of bits, which is the only figure that can be compared between two passwords. This page shows that number instead of guessing at a word like "strong".
How to use it
- 1 Set the length. The bar and the bit count update as you drag it.
- 2 Pick the character sets. Dropping symbols costs you bits, and the counter shows how many.
- 3 Press Generate and copy the one you want. Paste it straight into your password manager.
What a bit of entropy buys you
Each extra bit doubles the work an attacker has to do. The table below is the same arithmetic for four common alphabets, and it shows something people find surprising: a longer password from a small alphabet beats a short one from a large alphabet almost every time.
| Alphabet | 8 chars | 12 chars | 20 chars |
|---|---|---|---|
| Digits only (10) | 27 | 40 | 66 |
| Lowercase letters (26) | 38 | 56 | 94 |
| Letters and digits (62) | 48 | 71 | 119 |
| Everything, symbols included (76) | 50 | 75 | 125 |
How the "one from each set" rule is applied
The common shortcut is to build a random password and then overwrite a few positions to satisfy the rule, which makes those positions predictable and weakens the result. Here one character is drawn from each required set first, the rest are filled from the combined pool, and the whole thing is shuffled, so no position carries information about which set it came from.
Where the randomness comes from
From your device's cryptographic random source, through the same routine the randomizer tools on this site use. That routine draws an index by rejection sampling rather than by taking a remainder, because a plain remainder makes low indexes come up slightly more often, and in a password that quietly shrinks the search space an attacker has to cover.
A generated password is only half the job
A password this random cannot be remembered, and that is the point: it belongs in a password manager, not in your head or a note. Reusing even a very strong password across sites undoes the strength, because one breach then opens every account that shares it.