Sign up

Password Generator

Generate secure, random passwords with customizable criteria.

Password Settings

Configure the length and character types.

16
Generated Password
—

Choose your options and generate.

Strength: —

About this topic

Entropy & Strength Measuring a password in bits of randomness.

Password strength is mathematically measured in 'bits of entropy'. It is calculated based on the length of the password and the size of the character pool (e.g., lowercase letters, numbers, symbols).

Key formulas & rules

  • •Formula: Length × log₂(pool size)
  • •80+ bits is generally considered strong
  • •100+ bits is very strong
  • •Length is more important than complexity
  • •A 16-char password is stronger than an 8-char complex one
  • •Entropy prevents brute-force guessing

Examples

Input Output Note
8 lowercase (a-z) 37 bits Weak
12 lowercase (a-z) 56 bits Medium
16 mixed types 105 bits Strong
20 mixed types 131 bits Very strong

Real-world uses

Account security Password managers Data breaches
Character Classes The building blocks of a password.

The pool of available characters directly affects the entropy. Using uppercase, lowercase, numbers, and symbols together creates the largest possible pool (94 characters).

Key formulas & rules

  • •Lowercase: 26 characters
  • •Uppercase: 26 characters
  • •Numbers: 10 characters
  • •Symbols: 32 characters
  • •All combined: 94 characters
  • •More classes = harder to guess

Examples

Input Output Note
Lower only Pool = 26 Easy to type
Lower + Upper Pool = 52 Standard
Lower + Upper + Num Pool = 62 Common
All 4 classes Pool = 94 Maximum pool

Real-world uses

Password policies Compliance standards Security audits
Cryptographic Randomness Why Math.random() isn't safe for passwords.

Standard random number generators (PRNGs) are deterministic and predictable. This tool uses the Web Crypto API (crypto.getRandomValues), which is cryptographically secure and suitable for password generation.

Key formulas & rules

  • •Math.random() is predictable
  • •Crypto API uses hardware entropy
  • •No patterns or cycles
  • •Meets security standards
  • •Generates true random numbers
  • •Essential for cryptographic keys

Examples

Input Output Note
Math.random() Predictable Not safe
Crypto API Secure Used here
PRNG Deterministic Seed-based
CSPRNG Non-deterministic Secure

Real-world uses

Encryption keys Session tokens Password generation

Modes & formulas

1

Password Generator

• Choose the length (4–128) and which character classes to include. • The generator uses crypto.getRandomValues() for secure randomness. • It guarantees at least one character from each selected class, then shuffles with Fisher–Yates.
Entropy (bits) ≈ length × log₂(pool size)

Pool size is the total number of possible characters. For example, uppercase (26) + lowercase (26) + digits (10) + symbols (32) = 94 characters. A 16-character password from this pool has about 105 bits of entropy.

How to use it

Choose a length and toggle character classes. The password regenerates automatically. Click Copy Password to copy it to your clipboard, or Save to History to store the metadata (not the password itself).

Frequently asked questions

Is Math.random() secure enough?
No. Math.random() is a pseudo-random generator and is not cryptographically secure. This tool uses crypto.getRandomValues() instead.
How long should a password be?
At least 12 characters for strong security, 16+ for high-value accounts. Length matters more than complexity.
How does the generator create random passwords?
It uses the Web Crypto API (crypto.getRandomValues), which is cryptographically secure and suitable for generating secrets.
Is Math.random() secure enough for passwords?
No. Math.random() is a pseudo-random generator and can be predicted. This tool uses a secure CSPRNG (Cryptographically Secure Pseudo-Random Number Generator).
What is entropy?
A measure of randomness measured in bits. Each additional bit of entropy doubles the number of guesses required to crack the password.
How long should my password be?
For important accounts, use at least 16 characters. For lower-security accounts, 12 characters is usually sufficient.

Related calculators

Unit Converter Convert Length, Weight, Temperature, and Volume. Data Storage Convert between Bytes, KB, MB, GB, and TB. Speed Converter Convert between mph, km/h, m/s, knots, and ft/s. Fuel Efficiency Convert between MPG (US/UK), L/100km, and km/L. Compound Interest Calculate savings growth over time with regular contributions.
Read the full Password Generator guide — examples & 18 FAQs