What is a random password generator?
A random password generator is a tool that builds a password by picking characters with a cryptographically secure random number generator, instead of letting a person choose. People are predictable: we use names, dates, keyboard patterns and the same "Password1!" tweaks that attackers try first. A generator has no habits, so every character is an independent, unpredictable choice.
This strong password generator runs entirely in your browser. It uses crypto.getRandomValues, the Web Crypto API that browsers provide for security work, and it uses rejection sampling so every character in the pool is exactly equally likely (a simple "random number modulo pool size" approach would slightly favour some characters). The order of characters is then shuffled with the same secure source.
How to generate a strong password
- Set the length with the slider, from 6 to 64 characters. It starts at 16, and a new password appears as you drag.
- Choose character types: Uppercase (A-Z), Lowercase (a-z), Numbers (0-9) and Symbols (
!@#$%^&*()-_=+[]{};:,.?/). All four are on by default. The password always contains at least one character from each type you select. If you untick everything, lowercase is switched back on. - Tick "Avoid look-alikes (0O1lI)" if you will ever read the password aloud or type it from paper. It removes 0, O, 1, l and I.
- Check the strength meter. The bar and label (Weak, Fair, Strong, Very strong) are based on the entropy in bits, shown next to the label.
- Tap Regenerate for a new password with the same settings, then Copy password and save it straight into your password manager.
Password entropy explained simply
Entropy measures how many guesses an attacker would need, written in bits. Each extra bit doubles the number of possible passwords. The formula for a random password is: bits = length × log2(number of possible characters).
With all four character types on, this tool picks from 86 characters, so each character adds about 6.4 bits. With look-alikes removed the pool is 81 characters (about 6.3 bits each).
| Settings | Length | Entropy | Meter label |
|---|---|---|---|
| Numbers only (PIN style) | 6 | 20 bits | Weak |
| All four types | 8 | 51 bits | Fair |
| Lowercase only | 16 | 75 bits | Strong |
| All four types | 12 | 77 bits | Strong |
| All four types | 16 | 103 bits | Very strong |
| All four types | 20 | 129 bits | Very strong |
The meter uses these bands: under 40 bits Weak, 40-63 Fair, 64-95 Strong, 96 and above Very strong.
To put the numbers in perspective, imagine an attacker who has stolen a password database and can test 100 billion guesses per second (a hypothetical, well-funded offline attack). 51 bits falls in hours. 77 bits would take tens of thousands of years on average. 103 bits is out of reach for any foreseeable hardware. Notice that length beats complexity: 16 lowercase letters (75 bits) is nearly as strong as 12 characters of every type (77 bits).
Entropy only applies to truly random passwords. "Summer2026!" looks like it uses four character types, but attackers try words, years and a trailing symbol first, so its real strength is tiny.
How long should a password be?
- 12 characters (all types): the practical minimum for low-value accounts.
- 16 characters: a good default for everything stored in a password manager.
- 20 or more: email, banking, your password manager's master account (as a passphrase, see below), and admin accounts. Your email account can reset every other password, so protect it most.
Current NIST guidance (SP 800-63B) favours length over composition rules, says passwords should not be forced to change on a schedule unless there is evidence of compromise, and at the time of writing recommends at least 15 characters when a password is the only sign-in factor. Some older sites still cap length at 12 or 16 characters or reject certain symbols; if a site refuses a password, untick Symbols or shorten it rather than switching to something memorable.
Which settings to use: examples
- Wi-Fi network: WPA2 and WPA3 accept 8 to 63 characters. Use 20 or more, untick Symbols and tick "Avoid look-alikes" so guests can type it, or share it with a Wi-Fi QR code instead.
- Social media and email: 16 to 20 characters, all types on, saved in your manager, with two-factor authentication turned on.
- Streaming TV or console login: typing with a remote is slow, so use 16 to 20 characters with look-alikes and symbols off; length keeps it strong.
- Shared team account (a shop's Instagram, a client's website admin): generate a fresh password whenever someone leaves the team.
- Encrypted PDF or ZIP file: 20 or more characters, because a stolen file can be attacked offline with no limit on guesses. Send the password through a different channel from the file.
Passphrases: memorable passwords that are still strong
A passphrase is a password made of several random words, such as orbit-cactus-lantern-velvet-ninety-plume. It is easier to remember and type than q7#Rk!2vX9@m, and it can be just as strong, as long as the words are chosen randomly, not by you.
With the common Diceware method, each word is picked from a list of 7,776 words by rolling five dice, giving about 12.9 bits per word. Five random words give about 65 bits, six give about 78 bits, and seven about 90 bits. Use six or more words for a master password.
This tool generates character-based passwords, not word lists. Use a passphrase for the few passwords you must memorise (your password manager, your computer login), and use generated character passwords from this tool for everything stored in the manager. Most password managers also include a passphrase option.
Why you need a password manager
Strong random passwords only work if you use a different one for every account, and nobody can remember 100 of them. A password manager stores them encrypted behind one master passphrase, fills them in for you, and warns you about reused or breached passwords.
- Built-in options: Apple Passwords (iPhone, Mac), Google Password Manager (Chrome, Android) and Microsoft Edge all save and sync passwords for free.
- Dedicated managers: Bitwarden, 1Password, Proton Pass and KeePass-style apps work across every browser and device and add sharing and security reports.
- Add two-factor authentication (an authenticator app or a passkey) on email, banking and social accounts. Where a site offers passkeys, they are even more resistant to phishing than passwords.
Password vs passphrase vs passkey
| Random password | Passphrase | Passkey | |
|---|---|---|---|
| Example | v9#Tq2!mZr$8kLp@ | orbit-cactus-lantern-velvet-ninety-plume | Sign in with fingerprint, face or device PIN |
| Best for | Accounts saved in a password manager | Passwords you must remember | Sites that support passkeys |
| Memorable | No | Yes | Nothing to remember |
| Phishing risk | Can be typed into a fake site | Can be typed into a fake site | Bound to the real site, so resistant |
Passkeys are spreading across Google, Apple, Microsoft, Amazon and many other services, but most websites still need a password, and many passkey accounts keep a password as a backup. A generated password plus two-factor authentication remains the right default for everything else.
Common password mistakes to avoid
- Reusing passwords. When one site is breached, attackers try the same email and password everywhere ("credential stuffing"). One unique password per account stops this.
- Small edits to old passwords. Changing "Mumbai@2025" to "Mumbai@2026" is the first variation an attacker tries.
- Personal information. Names, birthdays, pet names, phone numbers and your Instagram handle are easy to find online.
- Storing passwords in notes or chats. A notes app, WhatsApp message to yourself or spreadsheet is not encrypted the way a password manager is.
- Short passwords with lots of symbols. 8 characters of every type (51 bits) is weaker than 16 lowercase letters (75 bits).
- Sharing by screenshot. If you must share access with a team member, use your password manager's sharing feature.
Is this password generator safe?
Yes. Passwords are generated on your device by JavaScript using the browser's cryptographic random number generator. Nothing is sent to our server, nothing is stored, and the page makes no network requests when you generate or copy a password; you can confirm this in your browser's developer tools under Network. Each password exists only on your screen and clipboard until you save it. As with any copied secret, clear your clipboard on shared computers.
Protect the accounts behind your link in bio
Your Instagram, email and link-in-bio accounts are your business front door, so each deserves its own generated password and two-factor authentication. When you create your Biolinko page, use a password from this tool and save it in your manager. Other handy free tools: the QR code generator and the UTM builder.
Updated October 8, 2026