Free strong password generator
This password generator makes strong random passwords or memorable passphrases in one click. Choose a length from 4 to 64 characters and tick the character sets you want (uppercase, lowercase, digits, symbols); you instantly get five options to pick from, plus the entropy in bits and an estimated crack time. It is a free password generator online: no sign-up, no app and no extension.
Nothing leaves your device. Every password is built inside your browser using crypto.getRandomValues, the same cryptographically secure random source that password managers use. The page sends no request when you generate, copy or change a setting, and nothing is stored – close the tab and the passwords are gone.
How to use the password generator
- Pick Random characters for the strongest password per character, or Passphrase for a password you can remember.
- Drag the length slider – for example to 12, 15 or 16 characters – or set the number of words.
- Tick the character types you need. Turn on Exclude look-alikes if you will type the password by hand or read it aloud.
- Press Generate new passwords, then use a Copy button. Paste the password straight into your password manager.
How strong is a random password? Password entropy explained
Strength is measured as entropy – the number of bits an attacker has to guess. For a password where every character is picked at random:
Entropy (bits) = L × log₂(N)
where L is the length and N is the pool of possible characters. That is how to calculate password entropy for any random password. This tool's full pool is 26 uppercase + 26 lowercase + 10 digits + 28 symbols = 90 characters, so each character adds log₂(90) ≈ 6.49 bits.
Worked example
A 16-character password from all 90 characters has 16 × 6.49 = 103.9 bits. There are 2¹⁰⁴ possibilities. An attacker doing 10¹⁰ guesses per second (a strong GPU rig against a fast hash) needs half of them on average: 2¹⁰³·⁹ ÷ 2 ÷ 10¹⁰ seconds ≈ 3 × 10¹³ years. The same formula shows why short passwords fail: 8 characters give only 51.9 bits, cracked in about 2.5 days at that speed.
| Length (all 90 characters) | Entropy | Rating | Average crack time at 10¹⁰/s |
|---|---|---|---|
| 8 characters | 51.9 bits | Weak | about 2.5 days |
| 12 characters | 77.9 bits | Good | about 450,000 years |
| 14 characters | 90.9 bits | Strong | billions of years |
| 16 characters | 103.9 bits | Very strong | trillions of years |
| 20 characters | 129.8 bits | Very strong | far beyond any hardware |
Rating bands used by the meter: under 36 bits very weak, 36–59 weak, 60–79 good, 80–99 strong, 100+ very strong. Entropy only counts for passwords chosen by a random process. "Priya@1995" looks complex but a cracker's word lists and rules find it in seconds, because it was chosen by a person, not by chance.
Which length should I pick?
Password generator 8 characters
Some old portals still cap passwords at 8 characters. If you must, use every character type – but treat 8 as the floor, not the goal.
Password generator 12 characters
Twelve random characters (about 78 bits) are good for most online accounts, where the site limits login attempts.
Password generator 14, 15 and 16 characters
A 16-character random password is our default and a sensible choice for email, banking and your password manager's vault. Use 14 or 15 characters when a site sets a maximum just below 16.
Passphrase mode: a password generator with words you can remember
A memorable password can still be strong if the words are picked at random – the idea made famous by the xkcd "correct horse battery staple" comic. This password generator with words draws each word from a built-in list of about 320 short, common English words. With a 323-word list each word adds log₂(323) ≈ 8.3 bits, so:
- 3 words ≈ 25 bits – easy to remember, too weak alone.
- 5 words ≈ 42 bits, plus a random number ≈ 51 bits – fine for a device PIN-style login with rate limits.
- 8 words ≈ 67 bits – a readable passphrase for daily use.
- 10 words or more ≈ 83+ bits – strong enough for a master password.
Choose a separator (hyphen, dot, underscore, space or none), capitalise each word and add a number to satisfy sites that demand an uppercase letter and a digit. Longer phrases from a small list are easier to type on a phone than symbol-heavy strings, and easier to remember than random characters.
Passwords for specific sites
- Password for email and Microsoft accounts: 16+ random characters, stored in a password manager, plus two-factor authentication.
- Password for WiFi: WPA2/WPA3 accepts 8–63 characters. A long passphrase in readable words is easy for guests to type; turn on Exclude look-alikes so nobody confuses 0 and O.
- IRCTC and EPFO: Government portals in India usually ask for 8–15 characters with at least one uppercase letter, one lowercase letter, one digit and one special character. Set the slider to 12–15 with all four sets ticked – every generated password contains at least one of each chosen type.
- Instagram and social apps: 12–16 characters is plenty, as long as the password is unique to that account.
- Sites that reject symbols: untick Symbols to get a password generator without special characters, and add length to compensate (18 letters and digits ≈ 107 bits).
Password generator with my name or my own words?
People often search for a password generator with name or a password generator using my words. It is safer not to: names, birthdays, pet names and favourite teams are the first things attackers try, and adding them reduces effective entropy to almost nothing. If you want something personal, generate a random passphrase and invent a silly picture that links the words – you get the memory hook without the weakness.
Password generator vs password manager
A generator makes the password; a manager remembers it. Use both: create a unique random password for every site here or inside your manager, and let the password manager fill it. Protect the manager itself with one long passphrase you actually remember. Reusing one strong password everywhere is still risky – a breach on one site exposes all of them.
How this generator avoids bias
A common bug in a password generator in Python or JavaScript is random() % N: when 2³² is not a multiple of N, some characters appear slightly more often. This tool uses rejection sampling – it throws away random numbers above the largest multiple of N and draws again – so every character and every word is exactly equally likely. If you are writing your own password generator code, use secrets.choice in Python or crypto.getRandomValues in JS, never Math.random.
Need a fair random pick for something else? Try the online dice roller or the spin the wheel random name picker, which use the same secure randomness.
Password generator tool vs the one in your password manager
Most password managers include a generator, and they work on the same principle as this password generator tool: random characters from a secure random source. The difference is that a manager also saves the result.
- Password generator LastPass: LastPass offers a generator in its vault and browser extension with length and character-type options.
- Password generator Bitwarden: Bitwarden's generator creates both random passwords and word passphrases, like the two modes here.
- Password generator Dashlane: Dashlane generates passwords while you sign up on a site and stores them automatically.
- Password generator Keeper: Keeper includes a generator that fills new passwords straight into forms.
- Password generator Zoho: Zoho Vault has a generator with policies that businesses can enforce for staff.
If you use one of these, its generator is fine. Use this page when you need a password quickly on a device without your manager, and then save it somewhere safe.
Password rules for popular sites
Sites set their own minimum rules, so generate a password that meets them. Rules change, so always check the sign-up form; a 16-character password with all four character types satisfies nearly all of them.
Password generator for IRCTC
IRCTC accounts need a password of 8 to 15 characters with at least one capital letter, one small letter and one number. Set the length to 12–15 here and keep upper case, lower case and digits on.
Password generator for EPFO (UAN)
The EPFO member portal asks for a password of 8 to 25 characters with upper case, lower case, a number and a special character. A 16-character password with symbols turned on meets this.
Password generator for Microsoft and email accounts
A Microsoft account password needs at least 8 characters and at least two of: upper case, lower case, numbers and symbols. For any password generator for email use, go longer – your email can reset every other account, so 16+ characters is worth it.
Password generator for Instagram
Instagram only requires 6 characters, but a password generator Instagram users can trust should give far more. Use 14–16 characters with symbols and turn on two-factor authentication.
Password generator xkcd style: four random words
The famous xkcd comic showed that "correct horse battery staple" – four random common words – is easier to remember and harder to crack than a short jumble like "Tr0ub4dor&3". The passphrase mode here is a password generator xkcd fans will recognise: choose 4–6 words and a separator. The strength comes from the words being picked at random, not by you.
Password generator quick and hard modes
For a password generator quick option, just press Generate: the default 16 random characters are strong enough for almost any account. For a password generator hard to crack even offline, raise the length to 20–24 characters or use 6+ passphrase words; each extra character multiplies the number of guesses needed by the size of the character set.
Password generator formula
The password generator formula for strength is entropy = length × log2(pool size). With 94 printable symbols, each character adds log2(94) ≈ 6.55 bits, so 16 characters ≈ 105 bits. The number of possible passwords is pool sizelength, and crack time is that number divided by the attacker's guesses per second.
Password generator in Python, JS, C and .NET
If you are building a password generator project Python is the easiest start, but the key rule in every language is the same: use a cryptographic random source, never a plain random() function.
- Python:
''.join(secrets.choice(alphabet) for _ in range(16))using thesecretsmodule. - Password generator js: use
crypto.getRandomValues()with rejection sampling, as this page does, instead of Math.random(). - Password generator in C: read bytes from
getrandom()or /dev/urandom on Linux (BCryptGenRandom on Windows) and map them to your alphabet without modulo bias. - Password generator .NET: in C# call
RandomNumberGenerator.GetInt32(alphabet.Length)for each character.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created in your browser with crypto.getRandomValues and are never sent to a server, logged or stored. You can even load the page, go offline and keep generating.
How long should a strong password be?
Use at least 12 random characters for ordinary accounts and 16 or more for email, banking and your password manager. As a passphrase, use 8 or more random words.
How do I calculate password entropy?
Multiply the length by log₂ of the character pool size. A 12-character password from 62 letters and digits has 12 × 5.95 = 71.5 bits. This only applies to randomly generated passwords.
What is a password you can remember but is still strong?
A passphrase of several randomly chosen words, such as Maple-Otter-Violin-Crab-Dawn42. Random words carry real entropy and are far easier to type and recall than symbols.
Can I make a password without special characters?
Yes. Untick Symbols. To keep the same strength, add length: 18 letters and digits give about 107 bits, more than 16 characters with symbols.
What does "exclude look-alikes" do?
It removes 0, O, o, 1, l, I and | so the password is easy to read and type by hand, for example a WiFi password on a printed card. It slightly lowers entropy per character.
Why does the generator show five passwords?
So you can pick one that fits a site's rules or is easier to type. Choosing from five random options costs only about 2 bits of strength.
Is this password generator as good as the LastPass or Bitwarden generator?
It uses the same kind of cryptographic randomness (crypto.getRandomValues), so the passwords are equally strong. A password manager adds storage and autofill; this page only generates.
What password should I use for IRCTC?
IRCTC asks for 8 to 15 characters with at least one capital letter, one small letter and one number. Generate a 12–15 character password with those types switched on and store it in a password manager.
What is the xkcd password method?
It means joining four or more randomly chosen common words, like the passphrase mode here. Random words are easy to type and remember while still giving high entropy.
Last updated 2026-09-18