Strong Password Generator
Generate strong, cryptographically secure passwords with maximum entropy. It defaults to 20 characters with all character types on. Change any setting and a new password generates instantly.
Generated locally in your browser via crypto.getRandomValues(). Never sent to our servers.
Password Entropy at Different Lengths
All character types enabled (pool size: 92 characters). Estimated crack time assumes 10 billion guesses per second.
| Length | Entropy (bits) | Strength | Est. Crack Time | Recommendation |
|---|---|---|---|---|
| 8 | 52 bits | Fair | ~2 hours | Too short for most accounts |
| 12 | 79 bits | Strong | ~1,300 years | Adequate for low-risk accounts |
| 16 | 105 bits | Very Strong | Billions of years | Good for most accounts |
| 20 ⭐ | 131 bits | Very Strong | Longer than universe's age | Our default (recommended) |
| 24 | 157 bits | Very Strong | Astronomical | High-value / sensitive accounts |
| 32 | 210 bits | Very Strong | Astronomical | Maximum security applications |
Note: Crack time is an estimate for offline brute-force against a fast hash. Real-world crack time varies significantly based on the hashing algorithm, attacker hardware, and attack type (brute-force vs dictionary).
What Makes This Generator Produce Strong Passwords?
True Cryptographic Randomness
Uses crypto.getRandomValues(), the same API browsers use for SSL/TLS. It never uses Math.random(), which is not cryptographically secure.
No Modulo Bias
Characters are selected using rejection sampling, ensuring every character in the pool has exactly equal probability. Biased selection would weaken randomness.
Guaranteed Character Types
The generator guarantees at least one character from each selected type (uppercase, lowercase, numbers, symbols), then fills the rest randomly and shuffles.
20-Character Default
Defaults to 20 characters, higher than most services recommend, to give you a comfortable margin of security above the minimum threshold.
Strong Password Checklist
Longer passwords have exponentially more possible combinations. Each character multiplies the search space.
Uppercase, lowercase, numbers, and symbols increase the character pool size, raising entropy per character.
Human-chosen "random" passwords are predictable. Attackers exploit patterns, keyboard walks, and substitutions (e.g. @ for a, 3 for e).
A strong password reused across multiple sites becomes weak the moment any one site is breached. Use a password manager to store unique passwords for every account.
Do not send passwords in plaintext email, SMS, or messaging apps. Your generated password exists only in your browser and clipboard.
Frequently Asked Questions
A strong password has four properties: it is long (at least 16 characters), random (generated by a cryptographically secure source, not chosen by a human), varied (uses uppercase, lowercase, numbers, and symbols), and unique (never reused on another site or service).
Length is the single most impactful factor. Each additional character multiplies the number of possible combinations exponentially, regardless of which character types you use.
We recommend a minimum of 16 characters for most accounts. This generator defaults to 20 characters to give a comfortable security margin. For extremely high-value accounts (email root accounts, password manager master keys, financial accounts), consider 24 or more characters.
The entropy table above shows exactly how much more secure each additional character makes a password.
Modern security guidance (NIST SP 800-63B) advises against mandatory periodic password changes unless there is specific evidence of compromise. Forced rotation often leads to weaker passwords as users use predictable patterns to meet rotation requirements.
You should change a password if: (1) you suspect it has been compromised, (2) a service you use has been breached, or (3) the password did not meet current strength standards.
A randomly generated 20-character password is extremely difficult to memorise. The correct approach is to store it in a reputable password manager (Bitwarden, 1Password, or your browser's built-in manager) and let the manager fill it automatically.
If you need a credential you can memorise, for example your password manager's master password, use a long passphrase of 5-6 random words instead. Try our Passphrase Generator.
Yes. All password generation happens in your browser using crypto.getRandomValues(). Your password is never sent to our server, never logged and never stored. It exists only in your browser's memory and your clipboard.
For a detailed discussion of browser-based generator safety, see our guide: Are Online Password Generators Safe?
Related Password Tools
Random Password Generator
The same cryptographic engine, focused on true randomness with a 16-character default.
Try it →Password Strength Checker
Test any existing password to see its entropy, strength level, and weaknesses.
Check now →Password Entropy Calculator
Calculate the exact entropy in bits of any password and understand what it means.
Calculate →Crack Time Calculator
Estimate how long a password would take to crack under different attack scenarios.
Estimate →Passphrase Generator
Generate memorisable word-based passphrases, great for password manager master keys.
Try it →Password Generator (Home)
The main generator with all options, a great starting point for any password.
Generate →Related Guides
What Makes a Strong Password?
A detailed look at length, randomness, character variety, and uniqueness.
GuideHow to Create a Secure Password
Step-by-step guidance for creating passwords that genuinely resist attack.
GuideAre Online Password Generators Safe?
Honest assessment of the risks and safeguards of browser-based generators.