Password Generator

Generate random passwords with adjustable length, character groups, and estimated entropy.

Length

18

Character pool

88

Estimated strength

Very strong

116 bits

Password settings

Generate a random password in the browser.

Generated password

Click Generate to create a password.

Use longer passwords with all character groups for accounts that support them. Do not reuse generated passwords across different services.

Related calculators

What is the password generator?

This tool generates cryptographically secure random passwords from uppercase letters, lowercase letters, numbers, and special characters. The source page emphasizes that weak passwords can be broken quickly by brute-force attacks and that generated passwords are not sent to a server.

Generation options and strength analysis

Password and passphrase generation

  • Password length can be set from 8 to 128 characters, with character groups toggled on or off.
  • Ambiguous characters such as 0 and O, or 1 and l, can be excluded to reduce manual-entry mistakes.
  • Sequential patterns such as abc and 123 can be avoided.
  • The generator guarantees that each selected character set appears at least once.
  • Korean passphrase mode uses a 200+ word dictionary, supports 3 to 8 words, separators, and optional numbers.
  • Bulk generation can create up to 50 passwords at once and download them as a TXT file.

Entropy grades

  • Very weak means entropy below 28 bits and can be cracked immediately.
  • Weak is 28 to 36 bits and can be cracked within minutes to hours.
  • Medium is 36 to 60 bits and can take days to years.
  • Strong is 60 to 80 bits and can take millions of years or more.
  • Very strong is 80 bits or higher and is practically uncrackable under the source assumption.
  • The crack-time estimate assumes 2026 high-end GPU speed of 10^12 hash operations per second; bcrypt, Argon2, and other slow hashes can change real attack time dramatically.

Security practice

Local processing and recommendations

  • The browser Web Crypto API crypto.getRandomValues is used instead of Math.random().
  • Recent 10 generated passwords are stored only in browser local storage with masking, display toggle, copy, delete, and strength badge features.
  • Use a unique password per site; reusing one password means one breach can endanger all accounts.
  • Use a password manager such as 1Password, Bitwarden, or KeePass, and enable two-factor authentication such as TOTP or security keys.
  • Change important account passwords every 3 to 6 months and check breach services such as Have I Been Pwned.
  • The strength comparison table lists 6 digits at about 20 bits, lowercase 8 characters at about 38 bits, mixed 12 characters at about 72 bits, mixed 16 characters at about 98 bits, and a 4-word passphrase at about 90+ bits.