This password generator creates random passwords of 8 to 64 characters, or PINs of 4 to 12 digits, in your browser, so the result never leaves your device. The default, 16 characters with all four types, gives 103.4 bits of entropy. Any change updates the entropy, a strength rating and crack times for three attacks. It is one of the free ghacks tools.
How to generate a strong password
Set the length, keep all character types on, and copy the result into your password manager.
- Set the length with the slider: 16 is the default; use 20 or more for a master password or a Wi-Fi key.
- Leave uppercase, lowercase, digits and symbols checked unless the site rejects one.
- Set How many to 5 or 10 to get several at once.
- Click Copy next to the password. If your browser blocks clipboard access, the password is selected for you; press Ctrl+C (Cmd+C on a Mac). Click Generate new password for a fresh one.
How long should a password be?
Use at least 16 random characters for accounts you care about; 12 is a practical floor. NIST's current guideline, SP 800-63B Revision 4, requires at least 15 characters when a password is the only sign-in factor and at least 8 when it is combined with a second factor, and it tells sites to accept passwords of at least 64 characters.
The table shows entropy and average crack time at one trillion guesses per second (the tool's fast-hash row).
| Length | Lowercase only (26) | Letters and digits (62) | All four types (88) |
|---|---|---|---|
| 8 | 37.6 bits, 0.1 seconds | 47.6 bits, 109 seconds | 51.7 bits, 30 minutes |
| 12 | 56.4 bits, 13 hours | 71.5 bits, 51 years | 77.5 bits, 3,417 years |
| 16 | 75.2 bits, 691 years | 95.3 bits, 755 million years | 103.4 bits, 205 billion years |
| 20 | 94.0 bits, 316 million years | 119.1 bits, 1.1 x 10^16 years | 129.2 bits, 1.2 x 10^19 years |
| 24 | 112.8 bits, 1.4 x 10^14 years | 142.9 bits, 1.6 x 10^23 years | 155.0 bits, 7.4 x 10^26 years |
Which characters should you include?
Turn on all four types unless a site rejects one; length adds more strength than symbols. The pool is 26 uppercase letters, 26 lowercase letters, 10 digits and 26 symbols (!@#$%^&*()-_=+[]{};:,.<>?/), 88 characters in total. Dropping the symbols shrinks the pool to 62 and costs about half a bit per character: 16 characters fall from 103.4 to 95.3 bits. Add two characters and you are ahead again, since 18 letters and digits give 107.2 bits.
At least one of each selected type is on by default, so every password contains each type you check. Drawing again until the rule is met keeps every qualifying password equally likely. Switch it off and about 16 percent of 16-character passwords would lack at least one type.
Turn on Exclude look-alikes (I l 1 O 0) when you have to type the password by hand, for example on a TV. The pool drops to 83 characters and the readout recalculates: 16 characters give 102.0 bits.
How strong is the generated password?
Strength is measured as entropy: bits = length x log2(pool size). With all four types, each character adds log2(88) = 6.459 bits, so 16 characters give 16 x 6.459 = 103.4 bits. Each added bit doubles the attacker's work. The rating reads very weak under 40 bits, weak under 60, fair under 75, strong under 100 and very strong from 100 bits.
Crack time depends on the attack, so the tool shows three, each 2^bits / 2 / guesses per second (an average attacker searches half of all possibilities):
| Attack | Guesses per second | 16 characters, all four types |
|---|---|---|
| Online login attack, lockout ignored | 10 | 2.0 x 10^22 years |
| Stolen database, bcrypt cost 5, one RTX 4090 | 184,000 | 1.1 x 10^18 years |
| Stolen database, fast hash such as NTLM | 1 trillion | 205 billion years |
Above 10^15 years the tool says "longer than the age of the universe". The rates come from a hashcat benchmark of one RTX 4090 (288.5 billion NTLM guesses per second, so one trillion is about 3.5 cards); higher bcrypt costs are slower to attack. Our test of how long it takes to crack a password covers real-world speeds.
Strong password examples (and why not to use them)
A password printed on a web page is no longer secret; use these only as patterns.
_euWd;xlZa7e!KB(: 16 characters, all four types, 103.4 bits.zCscV7zoEB6OMSwl8Xcc: 20 letters and digits, 119.1 bits, for sites that reject symbols.
Common mistakes:
- Reusing one password on several sites, so one breach unlocks all of them. You can check passwords against the Pwned Passwords database to see whether one has leaked.
- Predictable swaps such as P@ssw0rd!, which cracking tools try first.
- Choosing words or dates yourself; human choices are far less random than the formula assumes.
Password or passphrase?
A 6-word passphrase is as strong as a 12-character random password and easier to type. Six words drawn from a 7,776-word list give 6 x log2(7,776) = 77.5 bits, the same as 12 characters from the 88-character pool. Use a passphrase where you type it yourself, such as a computer login or master password, and random characters wherever a manager fills it in.
PIN generator
For a numeric code, use the PIN tab: 4 to 12 digits, default 6. Each digit adds only log2(10) = 3.32 bits, so 6 digits give 19.9 bits. At 10 guesses per second a 6-digit PIN falls in about 14 hours on average, so use PINs only where a device or card locks after a few wrong tries.
FAQ
Is an online password generator safe?
A generator is safe when the password is created on your device and never transmitted. This one runs in your browser: nothing is sent to a server, stored or logged. To verify, open the developer tools, switch to the Network tab and generate a few passwords; no requests appear. Or load the page, go offline and keep generating.
How does this password generator create randomness?
It uses crypto.getRandomValues from the Web Crypto API, the cryptographically secure random number generator in every modern browser. To map random numbers onto the pool without favoring some characters, it uses rejection sampling: values that would cause modulo bias are discarded and drawn again, so every character is equally likely at every position.
Should I use my browser's built-in generator instead?
Use the built-in generator if you save passwords in that browser, since it fills and stores the password in one step. This tool helps when you need a password outside a sign-up form, such as a Wi-Fi key, want a specific length or character set, or use a separate password manager.
Where should I store generated passwords?
Store them in a password manager, not a text file. Open-source options include KeePass, which keeps an encrypted database on your device, and Bitwarden, which syncs across browsers. Turn on two-factor authentication for key accounts, and use passkeys where a site offers them.
Sources
- NIST SP 800-63B Revision 4, Digital Identity Guidelines: Authentication and Authenticator Management
- MDN Web Docs: Crypto.getRandomValues()
- Chick3nman: hashcat v6.2.6 benchmark of an RTX 4090 (2022)
- Entropy and crack-time figures: ghacks calculation with the formulas above, reviewed 2026-11-08.