Password Generator

A password generator creates random passwords that people and computers cannot guess. A 16-character password using upper and lower case letters, numbers and symbols has about 104 bits of entropy, far beyond what any attacker can brute-force. Passwords here are made on your device with your browser’s secure random generator and are never sent anywhere.

By Editorial Team Updated 19 Oct 2026

How to use this random password generator

Choose password or passphrase. Passwords suit a password manager; passphrases are easier to type and remember for the few logins you must memorise.
Set the length. Use at least 16 characters for passwords, or 7 or more words for passphrases from this list.
Pick character types. Keep all four types on unless a site rejects symbols. Tick “avoid look-alike characters” if you will read the password aloud or type it from paper.
Copy and save. Copy one of the results straight into your password manager. Click Generate new for a fresh set.

What makes a secure password

Strength comes from length and randomness, not clever substitutions. “P@ssw0rd!” follows every old complexity rule and is still one of the first guesses in any attack, because attackers try common words with predictable swaps. A password chosen randomly by a computer has no pattern to exploit.

Current guidance from the US National Institute of Standards and Technology (NIST SP 800-63B) and the UK National Cyber Security Centre agrees on the essentials:

Length matters more than complexity rules.
Every account needs a different password, so one breach cannot unlock the rest.
Use a password manager to store them and turn on two-step verification wherever you can.
Only change a password when there is a reason to, such as a breach.

How strength is measured: entropy in bits

Entropy measures how many guesses an attacker would need. For a random password it is length × log2(number of possible characters). Each extra bit doubles the guesses needed.

Password	Entropy	Average time to guess*	Rating
8 lowercase letters	37.6 bits	1 second	Weak
8 letters and numbers	47.6 bits	18 minutes	Fair
12 characters, all types	77.7 bits	39,133 years	Strong
16 characters, all types	103.6 bits	Trillions of years	Very strong

*Assuming an offline attack making 100 billion guesses a second against a fast, unsalted hash, which is close to the worst case. Online attacks are far slower because sites limit login attempts.

Using the passphrase generator

A passphrase is a string of random words such as draw-silly-cake-wise-quota-scam-sniff. It is long, easy to type on a phone and easier to remember than a jumble of symbols. The words are picked at random from the Electronic Frontier Foundation’s short word list of 1,296 easy-to-type words, so each word adds about 10.3 bits:

Words	Entropy	Rating
4	41.4 bits	Weak
5	51.7 bits	Fair
6	62.0 bits	Fair
7	72.4 bits	Strong

The words must be chosen randomly, not by you: a phrase you make up yourself, such as a song lyric, is far weaker than its length suggests. Use at least 7 words for important accounts.

Is it safe to use an online password generator?

It is safe when the password never leaves your device. This strong password generator runs entirely in your browser using the Web Crypto API (crypto.getRandomValues), the same secure random source browsers use for encryption. Nothing is sent to our servers, logged or stored, and results do not appear in the page link. For extra peace of mind, load the page and then disconnect from the internet: it still works.

Avoid generators that use ordinary Math.random(), which is predictable, or that show passwords in a URL.

Password generator FAQs

How long should a password be?

At least 16 random characters for accounts stored in a password manager. NIST’s 2025 guidance requires sites to set a minimum of 15 characters when a password is the only login factor, and recommends they accept at least 64, so longer is usually fine.

Do I need symbols in my password?

Not if the password is long and random. Symbols add strength per character, but adding length does the same job. Some sites still require them, so keep them on by default.

What is the best way to store passwords?

A reputable password manager. It generates, stores and fills unique passwords for every site, so you only need to remember one strong passphrase.

Are passphrases as secure as passwords?

Yes, if they are long enough and the words are chosen randomly. Seven random words from this list give about 72 bits, similar to a random 11-character password with all character types.

Should I change my passwords regularly?

No, current NIST and NCSC guidance says not to force regular changes. Change a password if a site reports a breach or you suspect it has been seen by someone else.

Sources and methodology

Characters and words are chosen with crypto.getRandomValues using rejection sampling, so every option is equally likely. Passwords are regenerated until they contain at least one of each selected character type. Entropy is length × log2(pool size) for passwords and words × log2(1,296) for passphrases, plus log2(10) + log2(word count) when a number is added. Guess times use half the keyspace at 10¹¹ guesses per second.