ToolPikaHow it works
Each character is picked with crypto.getRandomValues, the cryptographically secure random number generator built into your browser. The generator uses rejection sampling, so every character in the set is exactly equally likely. (The common shortcut of taking a random number modulo the set size makes some characters slightly more frequent.)
With every type selected, the characters come from a set of 90: 26 uppercase letters, 26 lowercase letters, 10 digits and 28 symbols (!#$%&()*+,-./:;<=>?@[]^_{|}~). Quotes, backslashes, backticks and spaces are left out because some sites and systems handle them badly.
Strength
The strength shown is the entropy of the password: its length multiplied by log₂ of the number of possible characters.
| Password | Entropy | Rating |
|---|---|---|
| 8 lowercase letters | 37.6 bits | Very weak |
| 8 characters, all types | 51.9 bits | Weak |
| 12 letters and digits | 71.5 bits | Fair |
| 12 characters, all types | 77.9 bits | Fair |
| 16 characters, all types | 103.9 bits | Very strong |
| 20 characters, all types | 129.8 bits | Very strong |
This applies to random passwords like the ones generated here. A password you invent yourself, such as Summer2026!, looks complex but is guessed quickly because attackers try common words and patterns first.
Good practice
- Use a different password for every account. When a site is breached, reused passwords are tried everywhere else.
- Store them in a password manager rather than a note or a spreadsheet. It fills them in for you, so length costs nothing.
- Turn on two-factor authentication for email, banking and any account that can reset other accounts.
- Prefer length over complexity rules when you have the choice. Current NIST guidance favours longer passwords over forced mixes of character types.