Password Generator

Password Generator — Create Strong, Random Passwords Instantly

The human brain is genuinely bad at creating strong passwords. We naturally gravitate toward meaningful words, familiar dates, keyboard patterns, and predictable substitutions — all of which attackers account for in their cracking tools. When someone chooses a password themselves, they're effectively drawing from a much smaller pool of possibilities than a truly random password of the same length would represent. A random password generator solves this at the source: it produces passwords with real randomness drawn from a cryptographically secure source, drawn from a character set you define, at any length you need.

This generator uses the browser's crypto.getRandomValues() API — the same cryptographically secure randomness source used for generating encryption keys — to produce each password. Nothing is sent to any server; passwords are generated entirely on your device.

What Actually Makes a Password Strong

Password strength is fundamentally about entropy — the number of possible values an attacker would need to try to crack the password by brute force. Two factors determine entropy most: length and character set size.

Length: Each additional character multiplies the number of possible passwords by the size of the character set. A 12-character password from a 94-character set (all printable ASCII) has approximately 10²³ possible combinations. A 16-character version of the same has 10³¹. The difference is enormous. Length matters more than any other single factor — a 20-character lowercase-only password is stronger than a 10-character mixed password.

Character set size: Using only lowercase letters gives a 26-character alphabet. Adding uppercase adds 26 more (52 total). Adding digits adds 10 more (62 total). Adding symbols adds up to 32 more (94 total). Each expansion multiplies the difficulty of brute force by the ratio of character set sizes. A 12-character password from a 26-character set has significantly fewer possible values than the same length from a 94-character set.

Randomness: A password that's long and complex but based on a predictable pattern — a word with number substitutions, a keyboard walk, a name with a year — is far weaker than a shorter fully random password, because attackers run pattern-aware attacks before pure brute force. True randomness, with no pattern the attacker can model, is what cryptographic random generators provide.

Uniqueness: A strong password that's reused across multiple services becomes a liability when any one of those services suffers a data breach. Credential stuffing — automatically trying username/password pairs from one leaked database against other services — is one of the most effective and widely used attack methods. Every account needs its own unique password.

Entropy Calculation — Measuring Password Strength Mathematically

Entropy is measured in bits, and it represents the number of random choices needed to produce the password with certainty. The formula is straightforward: H = log₂(N^L), where N is the size of the character set and L is the password length. For example, a 12-character password drawn from lowercase letters only (N=26) has H = log₂(26¹²) ≈ 56.4 bits of entropy. The same length from the full printable ASCII set (N=95) gives H = log₂(95¹²) ≈ 78.6 bits.

What do these numbers mean in practice? An attacker using a single modern GPU can try roughly 10 billion SHA-256 hashes per second. At 56 bits of entropy, a brute-force attack takes about 215 million seconds — roughly 6.8 years. At 78 bits, that jumps to 38 billion years. This is why both length and character set matter: each additional bit of entropy doubles the time required for brute force.

Most security guidelines consider 80 bits of entropy the minimum for long-term security against offline attacks. For passwords that protect high-value targets (banking, server access, encryption keys), 100+ bits of entropy is advisable. A 20-character password from the full ASCII set provides roughly 131 bits — far beyond what any brute-force attack could crack.

It's worth noting that entropy calculation assumes true randomness. A password generated by a human, even one that "looks random," has far less entropy than its length suggests because humans don't pick uniformly from the character set. The entropy of a human-chosen password is often estimated at 2 to 3 bits per character, compared to 6.6 bits per character for a random printable ASCII password. This is why a 12-character random password is dramatically stronger than a 12-character "clever" password.

Passphrases vs. Random Character Strings

There are two fundamentally different approaches to generating strong passwords, and understanding both helps you choose the right one for each situation.

Random character strings (like kR9$mL2@xP4v) are what most password generators produce. They maximize entropy per character because every character is independently chosen from a large set. A 16-character random string from the full ASCII set has roughly 105 bits of entropy — unbreakable by brute force. The downside is that they're hard to type, impossible to remember, and nearly useless for anything you need to enter manually.

Passphrases (like correct-horse-battery-staple) concatenate random words with separators. They're easier to type and can be memorized, while still providing strong security through length. Four random words from a 2,000-word dictionary provide about 44 bits of entropy — not enough for high-security applications, but sufficient for many everyday uses. Five or six words push that to 52 to 63 bits, which is solid for most accounts. Eight words reach 84 bits.

The XKCD comic that popularized passphrases used the example "correct horse battery staple" and showed that it has more entropy than the typical complex password "Tr0ub4dor&3" while being far easier to remember. This remains good advice, with one caveat: the words must be randomly selected. Picking words that form a meaningful sentence ("the quick brown fox jumps") provides almost zero additional entropy beyond the first word, because humans are terrible at simulating randomness.

For the best of both worlds, password managers like Bitwarden and 1Password can generate random passphrases with configurable word count and separator characters. You get the memorability of words without the risk of human selection bias.

How Attackers Crack Passwords

Understanding attack methods clarifies why random passwords are important:

Dictionary attacks: The attacker tries every word in a large dictionary, including common passwords, leaked password databases, and known compromised credentials. The RockYou dataset alone contains over 14 million real passwords from a 2009 breach — if your password is in that list, it will be cracked in seconds. Any meaningful word, name, or phrase is in some dictionary.

Rule-based attacks: Tools like Hashcat apply transformation rules to dictionary words — capitalizing the first letter, replacing 'a' with '@', appending numbers, reversing the word. "Password1!" passes most complexity requirements but would be cracked almost instantly with rule-based attacks because it follows a predictable pattern that these tools are explicitly designed for.

Brute force: Trying every possible combination from the character set up to a given length. At modern GPU speeds, an 8-character password from a full printable ASCII set can be cracked in hours. A 12-character truly random password from the same set would take thousands of years — length and randomness together make brute force infeasible.

Credential stuffing: Using leaked username/password pairs from known breaches against other services. Highly effective when passwords are reused. Services like HaveIBeenPwned track whether your email appears in known breached datasets.

Rainbow table attacks: Precomputed lookup tables mapping hash values to their corresponding passwords. These only work against unsalted hashes. Modern password storage systems (bcrypt, Argon2, PBKDF2) use per-record salts that make rainbow tables impractical. However, if a service stores passwords with MD5 or SHA-1 without salt (yes, this still happens), rainbow tables are devastatingly effective.

Hybrid attacks: Combining dictionary words with brute-forced prefixes, suffixes, or character substitutions. For example, appending two random digits to every dictionary word. These attacks bridge the gap between dictionary and brute-force approaches and are effective against passwords that are "a dictionary word plus something."

NIST Password Guidelines — What Modern Standards Say

The National Institute of Standards and Technology (NIST) updated its password recommendations in Special Publication 800-63B, and the changes surprised many people who were used to the old complexity-rules approach.

Key recommendations: Minimum 8 characters for user-chosen passwords, minimum 6 characters for machine-generated passwords. No composition rules — NIST explicitly says requiring uppercase, lowercase, digits, and symbols is counterproductive because it narrows the pool of acceptable passwords without meaningfully improving security. Maximum password length should be at least 64 characters (many systems still cap at 16 or 20, which is too low).

What NIST says against: No periodic password expiration. Periodic forced changes cause users to make minimal, predictable modifications ("Password1" becomes "Password2"). No password hints on login pages. No knowledge-based authentication (security questions like "what's your mother's maiden name") because answers are often publicly discoverable.

Breach checking: NIST requires that new passwords be checked against lists of known-compromised passwords (like the HaveIBeenPwned API) at creation time. If a user's chosen password appears in a known breach, it must be rejected. This single measure eliminates millions of weak passwords more effectively than any complexity rule.

The practical takeaway: length and uniqueness matter far more than character-type complexity. A 16-character random passphrase is stronger and more user-friendly than an 8-character password forced to include uppercase, lowercase, digits, and symbols.

Custom Character Sets — Tailoring Passwords to System Requirements

Not every system accepts the full printable ASCII character set. Some restrict passwords to alphanumeric characters only. Others allow specific symbols but not others. Legacy systems might limit passwords to 8 or 12 characters. Understanding how to work within these constraints while still generating secure passwords is important.

When a system restricts characters, the response is not to make the password weaker — it's to make it longer. If you can only use lowercase letters and digits (36-character set), a 12-character password has about 62.4 bits of entropy. Extend that to 20 characters and you reach 104 bits — more than enough for any application. The principle is simple: compensate for a smaller character set with greater length.

Some specific system constraints to be aware of: certain banking systems strip or reject specific characters like &, <, >, ', and " because of legacy database encoding issues. Some older systems only accept ASCII and will corrupt or truncate non-ASCII characters. APIs sometimes have undocumented password character restrictions that only reveal themselves with error messages. When generating passwords for integration with external systems, test with the actual system early to avoid surprises.

This tool lets you toggle individual character types on and off, so you can generate passwords that comply with specific system requirements. If you need a password with only letters and numbers, disable the symbols toggle. If a system rejects a generated password, adjust the character set and increase the length to maintain entropy.

Password Managers — The Necessary Companion

Strong, unique, random passwords are only practical if you're not trying to memorize them. A password manager (Bitwarden, 1Password, Dashlane, KeePass, or the built-in managers in modern browsers) stores all your passwords securely, encrypted with a single master password that only you know. You only need to remember one strong passphrase; the manager handles every other credential.

Password managers also auto-fill login forms, alert you to reused or compromised passwords, and generate new random passwords directly — integrating generation and storage in one workflow. If you're currently reusing passwords or storing them in a spreadsheet or notes app, moving to a password manager is the single highest-impact security improvement most people can make.

The choice between a cloud-based manager (Bitwarden, 1Password) and a local one (KeePass) depends on your threat model. Cloud managers are more convenient — they sync across devices, auto-fill on mobile, and require zero infrastructure. KeePass stores your vault as a single encrypted file that you control entirely, which is appealing if you don't trust third-party services with your credential data. Both approaches are vastly better than not using a manager at all.

Recommended Password Settings

For general web accounts (email, social media, shopping): 16–20 characters with uppercase, lowercase, numbers, and symbols. Store in a password manager.

For admin and developer credentials (server SSH keys, database passwords, hosting dashboards, cloud console accounts, API admin panels): 24–32 characters with all character types. These are high-value targets — longer is always better.

For service accounts and API keys: 32+ characters, all character types, stored securely in environment variables or a secrets manager — never hardcoded in source code.

For passwords you need to type manually (device login, encrypted drive passphrase): Consider a passphrase — four or five random common words joined together. "correct-horse-battery-staple" is long, highly random, and easier to type than a string of symbols. At 28+ characters, it has excellent entropy.

Frequently Asked Questions (FAQs)