Password Generator
Generate a secure random password instantly. Choose length and character types — get a strong password with entropy score and strength rating.
#
Enter your values above to see the results.
Tips & Notes
- ✓A strong password is at least 12 characters and uses a mix of uppercase, lowercase, numbers, and symbols. Length is the single most impactful factor.
- ✓Use a unique password for every account. Password reuse means one breach can compromise dozens of accounts.
- ✓Consider using a password manager (Bitwarden, 1Password, Dashlane) to store and auto-fill complex passwords without needing to remember them.
- ✓Passphrases. four or more random words strung together. are both memorable and strong. "correct-horse-battery-staple" is stronger than "P@ss1".
- ✓Enable two-factor authentication (2FA) on important accounts. Even if your password is stolen, 2FA stops unauthorized access.
Common Mistakes
- ✗Using a length less than 8. very short passwords are trivially crackable by brute force. Use 12+ for important accounts.
- ✗Including only letters. adding digits and symbols dramatically increases the number of possible combinations.
- ✗Using predictable patterns like "Password1!". common substitutions (@ for a, 1 for i) are the first things password crackers try.
- ✗Reusing passwords across multiple sites. if one site is breached, attackers will try your email and password on every major service.
- ✗Writing passwords on sticky notes or in plain-text files. store passwords in a dedicated password manager, not unencrypted documents.
Password Generator Overview
Password security is the foundation of digital account protection. Understanding what makes passwords strong — and how quickly weak ones can be broken — reveals why length and randomness matter far more than complexity rules like "must include a special character."
Password entropy formula:
Entropy (bits) = log₂(Character Set Size ^ Password Length)
EX: 12-character password using lowercase only (26 chars): log₂(26^12) = 56.4 bits. Same length with all character types (95 chars): log₂(95^12) = 78.9 bits — 2^22.5 = 6 million times harder to crack.Password strength by length and character set:
| Length | Lowercase Only | +Uppercase | +Numbers | +Symbols (95 chars) | Time to Crack* |
|---|---|---|---|---|---|
| 8 chars | 37.6 bits | 45.6 bits | 47.6 bits | 52.4 bits | Hours-days |
| 10 chars | 47.0 bits | 57.0 bits | 59.5 bits | 65.5 bits | Months-years |
| 12 chars | 56.4 bits | 68.4 bits | 71.5 bits | 78.6 bits | Centuries |
| 16 chars | 75.2 bits | 91.2 bits | 95.3 bits | 104.9 bits | Eons |
| 20 chars | 94.0 bits | 114.0 bits | 119.1 bits | 131.1 bits | Infeasible |
| Attack Type | How It Works | Defeated By |
|---|---|---|
| Brute force | Try every combination | Long passwords (12+ chars) |
| Dictionary attack | Try common words/phrases | Random character passwords |
| Credential stuffing | Use leaked passwords from breaches | Unique password per site |
| Phishing | Trick user into revealing password | MFA + security awareness |
| Keylogging | Record keystrokes with malware | Clean device + MFA |
| Shoulder surfing | Watch password being typed | Privacy screen + passphrases |
Frequently Asked Questions
Password length is the single most important factor in security. Current recommendations from NIST (2024): minimum 8 characters for most accounts, 12-16 characters for financial and sensitive accounts, 20+ characters for master passwords and high-value targets. A 12-character random password using all character types has approximately 72 bits of entropy — it would take centuries to crack with current computing power. A 20-character password has 120+ bits of entropy — considered computationally infeasible to brute-force even with advanced hardware.
Password strength comes from entropy — the mathematical measure of unpredictability. Entropy (bits) = log2(character_set_size^length). A 12-character password using all 95 printable ASCII characters: log2(95^12) = 78.9 bits. Key factors in order of importance: length (most important), character set diversity (uppercase + lowercase + numbers + symbols), true randomness (not dictionary words or patterns), and uniqueness (different password for every account). A 16-character truly random password beats a complex but shorter one.
Passphrases (multiple random words: "correct horse battery staple") offer high security with better memorability. A 4-word passphrase from a 7,776-word dictionary has 51 bits of entropy — less secure than a 12-character random password (78+ bits) but far more memorable and resistant to shoulder surfing. NIST now recommends passphrases over complex short passwords for memorized credentials. For passwords managed by a password manager (which you should use), random character passwords are superior because memorability is irrelevant.
A password manager stores all your passwords in an encrypted vault protected by one strong master password. You only memorize one password; the manager generates and fills unique strong passwords for every site. Top options: Bitwarden (free, open-source), 1Password ($3/month), Dashlane, and LastPass. The security model: even if the password manager company is breached, your vault is encrypted with your master key and cannot be decrypted without it. Using a password manager with unique 16+ character passwords per site is dramatically safer than reusing passwords — credential stuffing attacks use leaked passwords from one breach to access other accounts.
Entropy measures password unpredictability in bits. Each bit of entropy doubles the number of guesses needed to crack the password. Formula: entropy = log2(character_set_size^length). Examples: 8-char lowercase only (26^8) = 37.6 bits — crackable in seconds with modern hardware. 8-char mixed case + numbers + symbols (94^8) = 52.4 bits — hours to days. 12-char mixed (94^12) = 78.7 bits — centuries. 16-char mixed (94^16) = 104.9 bits — practically uncrackable with current technology. NIST recommends at least 80 bits of entropy for high-value accounts.
NIST revised its guidance in 2017 and no longer recommends mandatory periodic password changes unless there is reason to believe a password was compromised. Frequent mandatory changes actually reduce security — users respond by making minor, predictable changes (Password1 → Password2) rather than creating new strong passwords. Instead: use a unique, long random password for each account; enable multi-factor authentication (MFA) wherever available; change a password immediately when a breach is reported; change passwords if you have reason to believe they were seen or compromised. MFA makes compromised passwords far less dangerous.