Sign up
Password Generator calculator →

Password Generator guide

The Password Generator creates cryptographically secure random passwords. You can customize the length and include uppercase letters, lowercase letters, numbers, and symbols.

Worked examples

Generate a high-security password

  1. Set the Length slider to 16.
  2. Check all boxes (Uppercase, Lowercase, Numbers, Symbols).
  3. Click Generate.
Result: e.g., tR7$mP9!qL2@vX5z

A 16-character password using all character types has about 105 bits of entropy, making it extremely difficult to brute-force.

Generate a PIN code

  1. Set the Length to 4 or 6.
  2. Uncheck Uppercase, Lowercase, and Symbols (leave only Numbers).
  3. Click Generate.
Result: e.g., 8392

This restricts the password to digits only. Note that this has very low entropy and is only suitable for device PINs.

Check password strength

  1. Type a password (or generate one).
  2. Look at the Strength Meter below the text box.
Result: Weak / Medium / Strong

The meter uses the entropy formula (Length × log₂(pool size)) to estimate how hard the password would be to crack.

Tips

  • •Length is more important than complexity. A 20-character password with only lowercase letters is stronger than an 8-character password with symbols.
  • •Never reuse passwords across different websites.
  • •Use a password manager to store these generated passwords securely.

Frequently asked questions

How does the generator create random passwords?
It uses the Web Crypto API (crypto.getRandomValues), which is cryptographically secure and suitable for generating secrets.
Is Math.random() secure enough for passwords?
No. Math.random() is a pseudo-random generator and can be predicted. This tool uses a secure CSPRNG (Cryptographically Secure Pseudo-Random Number Generator).
What is entropy?
A measure of randomness measured in bits. Each additional bit of entropy doubles the number of guesses required to crack the password.
How long should my password be?
For important accounts, use at least 16 characters. For lower-security accounts, 12 characters is usually sufficient.
Why is a longer password better?
Because the time required to brute-force a password grows exponentially with its length.
Is it safe to generate passwords online?
Yes, because the generation happens entirely in your browser using JavaScript. Nothing is sent to a server.
What are symbols?
Special characters like !@#$%^&*()_+. They increase the size of the character pool, making the password harder to guess.
Why did the tool force a character from each selected type?
To ensure the password meets common website complexity requirements (e.g., "must contain at least one number").
Can I use this for Wi-Fi passwords?
Absolutely. A 20+ character password with symbols is ideal for a home router.
What is a passphrase?
A password made of multiple random words (e.g., "correct horse battery staple"). They are often easier to remember and very secure.
Are the passwords stored anywhere?
No. The calculator does not save the generated passwords to your history or to any database.
What should I do if I forget a generated password?
You will need to use the "Forgot Password" link on the website. This is why password managers are highly recommended.
Can I copy the password directly?
Yes, there is a "Copy Password" button that copies the generated text to your clipboard.
What is the ideal character length?
The tool allows up to 128 characters, but 16-20 is typically the sweet spot for security and compatibility.
Why do some sites reject symbols?
Older or poorly designed systems sometimes restrict certain special characters. You can uncheck "Symbols" to generate an alphanumeric password.
What is a dictionary attack?
A method where hackers try common words and phrases. Generated random passwords are immune to dictionary attacks.
Does using a password manager help?
Yes. It allows you to have a unique, complex password for every site without needing to memorize them.
Is it bad to write my password down on paper?
It is safer than reusing a weak password online. Store the paper in a secure, offline location.