Password Generator
A long, random password is one of the best defences for your accounts. This tool creates one using your browser's cryptographically secure random number generator. The password is made on your device and is never sent over the internet or saved.
Last reviewed:
Your password
Press Generate
Choose the length and the types of characters, and see an estimate of its strength. Use a different password for every account and keep them in a password manager.
How to use this calculator
- Set the length. 16 or more characters is a good choice.
- Choose which types of characters to include.
- Click Generate, then Copy password.
- Save it in a password manager and do not reuse it on other sites.
Formula and variables
Strength (bits) = Length × log₂(number of possible characters)
- Length - number of characters in the password.
- Possible characters - 26 lower case, 26 upper case, 10 digits and 24 symbols, for those you select.
- Bits - each extra bit doubles the number of guesses an attacker needs.
Strength is an estimate that assumes every character is random. Passwords you invent yourself are usually much weaker than this.
Worked example
A 12-character password using upper case, lower case and digits.
| Length | 12 |
|---|---|
| Characters | A–Z, a–z, 0–9 (62 possible) |
| Strength | about 71 bits (Strong) |
- There are 62 possible characters at each position.
- log₂(62) is about 5.95 bits per character.
- 12 × 5.95 is about 71 bits.
What changes the result
- Length. Every added character multiplies the work for an attacker, so length matters most.
- Character variety. More character types help, but a longer password beats a short complex one.
- Reuse. A strong password reused on many sites is only as safe as the weakest of those sites.
- Storage. Use a reputable password manager rather than writing passwords in notes or messages.
Benefits and practical uses
- Truly random, not human-guessable.
- Never leaves your device.
- Choose characters that suit each site's rules.
Assumptions and limitations
- Randomness comes from crypto.getRandomValues, with unbiased selection.
- At least one character from each chosen type is included.
- Some sites reject certain symbols. Turn symbols off if a site does.
Frequently asked questions
Is it safe to generate a password online?
With this tool, yes: the password is created in your browser and never transmitted. Even so, avoid generating passwords on shared or untrusted devices.
How long should my password be?
At least 12 characters, and 16 or more for important accounts such as email and banking.
Why avoid look-alike characters?
Characters such as I, l, 1, O and 0 are easy to confuse if you ever have to type the password by hand.
Do you store my passwords?
No. Nothing is saved or sent, and the password disappears when you close the page.
Should I change passwords regularly?
Change them if there is a breach or suspicion. Using a unique strong password and two-factor authentication matters more than frequent changes.
What is two-factor authentication?
A second check, such as a code on your phone, that protects your account even if the password leaks.
References
- CERT-In: Indian Computer Emergency Response Team
- MDN: Crypto.getRandomValues()
- Cyber Dost, Government of India
Page last reviewed on . This calculator gives estimates for planning only; it is not financial advice and not an offer from any lender.