Tools · Passwords, passphrases and randomness
Random password generator
Unbiased random passwords with the entropy counted exactly, including what a "must contain a symbol" rule costs you.
Passwords are made in your browser with its cryptographic random number generator and are never sent anywhere. We never see them.
This random password generator makes strong passwords in your browser from its cryptographic random number generator. Pick the length and the character sets, and the tool shows each password's strength in bits. Nothing is sent anywhere, so we never see the passwords you make.
Use a password manager, and let it do this
A random password is for a machine to remember. If you don't have a password manager yet, getting one does more for your security than any setting on this page. It lets you use a different random password for every account, so a leak from one site is a problem for one site. This generator is for when you need a password right now, or when you want to see how length and character choice change the number. For the one password you do have to remember, the master password, use a passphrase of random words instead.
Length matters more than variety
Entropy is the length times the logarithm of the alphabet size, so each extra character adds the same amount. Adding symbols to the alphabet adds very little compared with adding a character. A random password of 12 lower-case letters has about 56 bits. Switching to upper and lower-case letters and digits (62 characters) makes 12 characters worth 71 bits, and adding symbols (about 94) makes it 79. But simply making the lower-case one 20 characters long gives 94 bits. The table computes these figures live, from the same function the tool uses:
| Alphabet (size) | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|
| a–z (26) | 37.6 bits | 56.4 bits | 75.2 bits | 94.0 bits |
| a–z, 0–9 (36) | 41.4 bits | 62.0 bits | 82.7 bits | 103.4 bits |
| A–Z, a–z, 0–9 (62) | 47.6 bits | 71.5 bits | 95.3 bits | 119.1 bits |
| all 94 printable ASCII (94) | 52.4 bits | 78.7 bits | 104.9 bits | 131.1 bits |
Past about 80 bits, brute-force guessing is out of reach for any attacker we know of, provided the password is stored sensibly. Where it ends up stored makes a huge difference, and the crack-time estimator shows how much.
"Use every ticked kind" without cheating
Plenty of sites insist that a password contain a capital, a digit and a symbol. The easy way to build one that satisfies this is to pick one character from each required kind, fill the rest from the whole alphabet, and shuffle. That's biased. The mix of kinds is no longer uniform, and some valid passwords become more likely than others, which an attacker who knows the method can exploit. This tool does it differently. It draws a whole password uniformly from the full alphabet, and if a ticked kind is missing, it throws the password away and draws again. Every password that satisfies the rule is then exactly equally likely.
The page counts the cost exactly. The number of strings of length L over an alphabet of N characters that include at least one of each of m kinds follows from inclusion and exclusion. Take every length-L string, subtract those missing each kind, add back those missing two, and so on. The tool does this with exact integer arithmetic (BigInt) and shows the entropy of the result. From the full 94-character alphabet with four kinds required (scripts/examples/password-rule-cost.mjs prints these), the rule costs 1.12 bits at 8 characters, because only 46% of random 8-character strings contain all four kinds. At 12 characters it costs 0.52 bits, and at 16 it costs 0.28. Choosing from a smaller set always makes a password weaker, so the price of a policy is visible. That's part of why NIST now advises sites not to impose composition rules at all.
This is the same family of mistake as the bug we found in our own passphrase generator (modulo bias), a method that looks random and subtly isn't. Judge a generator by its distribution, not by how its output looks.
Common questions
Why leave out look-alikes?
For passwords you might have to read aloud or type from paper. I, l, 1, O, 0 and | are easy to confuse in many fonts. Leaving them out removes six characters from the alphabet and costs a few tenths of a bit of entropy.
Which symbols are safe?
That depends on the site. Some reject certain characters, and some mishandle quotes, backslashes or spaces in forms. The default set avoids quotes, backslashes and spaces. Edit the box to match what a site allows, and the entropy updates.
How is the randomness chosen?
Each character comes from crypto.getRandomValues, the browser's operating-system-backed generator, through our randInt function, which discards values that would make some characters more likely than others. Random numbers in the browser explains why that matters and why Math.random() must never be used for this.
Is it safe to use a web page to make passwords?
It's as safe as the page's code, which makes no network requests and is readable. The strongest position is a password manager's built-in generator. If you use this page, copy the password straight into the manager and close the tab.