Strength
--
🔐
Password Generator
Pick a length, tick character types, get a secure password. One-click copy, strength indicator, all client-side.
Entropy (bits)
--
How strong is your password?
We estimate strength using entropy in bits: length × log₂(pool size). 70 bits is the point where brute-forcing becomes economically unfeasible for anything short of nation-state attackers. Aim for 16+ characters from 3+ pools to clear this bar comfortably.
Best practices
Use a password manager to store these — you only need to remember one master password. Never reuse the same password across sites. Turn on two-factor authentication wherever possible. A 16-character random string from this generator is effectively unguessable.
Frequently asked questions
Is this safe?
Yes — generated in your browser with <code>crypto.getRandomValues()</code>, cryptographically secure randomness. Nothing leaves your device.
How long should it be?
16+ characters with 3+ types clears ~80 bits. 12 with 4 types clears ~78 bits. Under 10 characters is risky no matter what.
Should I use this for a master password?
Generate here, then paste into your password manager's master password field. Do not rely on this page to remember it — close the tab and it is gone.
What if I need to type it on a TV remote?
Reduce length and use only digits + uppercase (no symbols). 12 uppercase letters/numbers = 72 bits — still plenty strong.
Can it be hacked?
Long random passwords almost never fail through brute force — they fail through phishing, keyloggers, or database leaks. Unique password per site protects you from all except local malware.
Last updated
For general calculations only. Not financial, tax, or legal advice — see our disclaimer.