Password Generator - Free, Strong & Random

Use this free password generator to create random passwords from 4 to 64 characters, choose which character types to include, and see the entropy and a crack-time estimate before you copy the result. It is for anyone who needs a unique, hard-to-guess password for a new account, a replacement login or a shared team credential.

What Makes a Generated Password Strong?

A strong password is long, random and used on only one account. Security people measure that strength in bits of entropy, which describes how many different passwords the generator could have produced. Every extra bit doubles the number of guesses an attacker would need.

Entropy equals the password length multiplied by the base-2 logarithm of the character pool. The pool is the set of characters you allow. In this tool lowercase letters add 26, uppercase letters add 26, numbers add 10 and symbols add 26, so all four together give a pool of 88 characters.

Randomness matters as much as the math. A password like "Summer#1" looks complex, but people pick patterns like it all the time, so guessing lists try it early. A string drawn at random from a large pool has no pattern to guess. NIST guidance on digital identity also favors length over forced complexity rules, which is why the Length slider is the most important control on this page.

How to Use the Password Generator

You can create a password in under ten seconds. The tool produces a first password as soon as the page loads, and it makes a new one each time you change a setting.

1. Drag the Length slider anywhere from 4 to 64. It starts at 16, which suits most accounts.
2. Tick or untick Lowercase, Uppercase, Numbers and Symbols. All four are on by default, and the tool will not let you turn off the last one.
3. Turn on Exclude ambiguous (0 O l I 1) if you will ever type the password by hand or read it aloud. Turn on No repeated characters if a rule requires every character to be different.
4. Pick a Quantity of 1, 5, 10 or 20.
5. Press Generate, or use the Regenerate icon next to the password box, to get a fresh result.
6. Check the strength bar, Entropy, Char Pool and Cracking time estimate under the password.
7. Use the copy icon for a single password. For a batch, open the Generated Passwords list and press Copy All.

Worked Example: How Settings Change Strength

The same tool can produce very different strength depending on length and pool size, and the numbers show why length wins. Suppose a site only allows letters and digits, so you untick Uppercase and Symbols and leave Lowercase and Numbers on. The pool is 36 characters. At length 12 the entropy is about 62 bits (12 × 5.17).

Now turn everything back on at length 16. The pool becomes 88, and the entropy is about 103 bits (16 × 6.46). Raise the slider to 20 and it reaches about 129 bits. Here is how those setups compare.

The 16-character password is roughly 41 bits stronger than the 12-character one, which means the attacker's work is multiplied by about two trillion. Four more characters bought far more safety than any single character type could.

How Do You Read the Strength Results?

The results panel gives you four signals: a strength bar with a label, the entropy in bits, the size of the character pool and a cracking time estimate. Read them together rather than relying on one.

Entropy

As a widely used rule of thumb, under 50 bits is weak for anything that matters, 60 to 80 bits is reasonable for low-value accounts, and 80 bits or more is strong. For email, banking, cloud storage and your password manager's master login, aim for 100 bits or more. If the number is lower than you want, raise the length first.

Char Pool

This number is how many different characters the generator can pick from. If it is small (say 10 for numbers only), the password is easy to brute force even at 20 characters. Adding one more character type is the quickest way to grow it.

Cracking time estimate

The estimate converts entropy into a time range. Large values appear with suffixes such as K years, M years and B years, and you may see "At most" before a figure or "Not measurable" when the number is too large to express. Treat it as a comparison between settings, not a promise. Real attackers differ in speed, and the estimate cannot know whether the site stores passwords safely.

What Password Length Should You Choose?

For most accounts, 16 characters with all four types is a sound default, and many people search for 12, 16 or 20 character options specifically. The right length depends on what the account protects and what the site allows.

• 8 to 11 characters: use only when a site enforces a short limit, and compensate by keeping all four character types on.
• 12 to 15 characters: acceptable for ordinary accounts, as long as the password is random and unique.
• 16 to 24 characters: a good choice for email, finance and work logins.
• 32 to 64 characters: useful for passwords you will never type, such as those saved in a password manager or used for service accounts.

Length 4 to 7 is available on the slider, but those passwords are too short to protect a real account. Use them only for throwaway tests.

When Is a Password Generator the Right Tool?

A generator is the right choice any time you would otherwise invent a password yourself. Here are the situations where it helps most.

• New sign-ups: create a unique password instead of reusing an old one.
• After a breach notice: replace the exposed password right away with a fresh random one.
• Team onboarding: set Quantity to 10 or 20 and generate a batch of temporary passwords, then copy them all at once.
• Wi-Fi and device codes: turn on Exclude ambiguous so guests do not confuse a zero with the letter O.
• Sites with strict rules: untick Symbols for a site that rejects them and raise the length to make up the difference.

If you already have a password and want to know how it holds up, run it through the password strength checker instead. Developers who need to store passwords safely can look at the bcrypt hash generator or the password encryptor for hashing.

Best Practices, Common Mistakes and Troubleshooting

The generator does the hard part, so most problems come from how the password is handled afterward. These are the mistakes that come up most often.

Habits that keep a password strong

• Use one generated password per account, never two.
• Save it in a password manager immediately after copying, because you cannot reliably memorize a 16-character random string.
• Turn on two-step verification wherever it is offered, since even a perfect password can be phished.
• Choose the longest length the site accepts when you will paste rather than type.

Mistakes to avoid

• Trimming the password to remember it. Deleting characters changes the entropy and removes the randomness you paid for.
• Regenerating until you find a "nice" one. Choosing by appearance adds a human pattern. Take the first result that meets the site's rules.
• Sending passwords in chat or email. Share them through a secure method, or generate a temporary one and require a change at first login.

Troubleshooting

• A site says the password is invalid. It likely blocks certain symbols or a length. Untick Symbols, enable Numbers and Uppercase, and increase the length.
• You cannot untick a box. At least one character type must stay selected, so tick another type first.
• No repeated characters gives a short or odd result. That option needs a large enough pool. If your length is close to or above the Char Pool number, add character types or shorten the password.
• The page says secure randomness is unavailable. Open the page over HTTPS or switch to a current browser. The buttons stay disabled until it works.

Limitations to Keep in Mind

This tool creates random character strings, not passphrases built from dictionary words, so a result such as "k9#Tq2" cannot be read like a sentence. If a site requires a memorable phrase, you will need another method. The entropy and crack-time figures are estimates based on the settings you chose, and they cannot account for a site that stores passwords poorly or for malware on your device.

Excluding ambiguous characters and forbidding repeats both shrink the pool slightly. That trade is usually worth it for readability, and you can offset it by adding a few characters of length.

You now have what you need to make a password that is long, random and unique. Set your length, pick your character types, press Generate, and copy the result straight into your password manager. For more protection tools, browse the security and encryption tools collection.