About Password Generator
The strength of a generated password comes from entropy, and entropy comes from the process, not from how complicated the result looks. A password is only as strong as the number of equally likely possibilities the generator could have produced - which means the only two things that matter are the size of the character set and the length, assuming the randomness is cryptographically secure.
The arithmetic is simple: entropy in bits is length times log2(alphabet size). A 16-character password from the 94 printable ASCII characters is about 105 bits. A 12-character one is about 79 bits. Both are far beyond offline brute force; the difference only matters against an attacker with an enormous budget and a stolen hash of a weak algorithm.
This is why the old composition rules - one uppercase, one digit, one symbol - have been dropped from current guidance. They add very little entropy while pushing people toward predictable patterns like Password1! that appear near the top of every cracking dictionary. NIST SP 800-63B now recommends length over composition, and explicitly advises against mandatory periodic rotation, which drives users to incrementing suffixes.
A passphrase of several random words is the alternative worth knowing about. Six words from a 7,776-word list gives about 77 bits - comparable to a 12-character random string - while being far easier to type and remember. The critical word is random: words you choose yourself have nothing like that entropy, because human choices cluster heavily.
Generation here uses crypto.getRandomValues, never Math.random(), and happens entirely in your browser - no password is transmitted or logged. The best practice remains to let a password manager generate and store it, so you never see or type it at all.
How to use the Password Generator
- Set the length. 16 characters or more for anything that matters; longer for a password protecting other credentials.
- Choose the character set. Broader is better, though length contributes more than variety.
- Generate and copy straight into a password manager rather than into a document or a note.
- Use a different password everywhere. Reuse, not weakness, is what turns one breach into many.
Password Generator in code
The same operation this tool performs, in the languages you are most likely to need it.
function generatePassword(length = 20, alphabet =
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*-_=+") {
const out = [];
// Rejection sampling: taking (byte % alphabet.length) directly would
// make the first few characters slightly more likely - a real, if
// small, bias. Discard bytes that fall in the incomplete final block.
const limit = 256 - (256 % alphabet.length);
while (out.length < length) {
for (const b of crypto.getRandomValues(new Uint8Array(length))) {
if (b >= limit) continue;
out.push(alphabet[b % alphabet.length]);
if (out.length === length) break;
}
}
return out.join("");
}
// Entropy in bits
const entropy = (len, alphabetSize) => len * Math.log2(alphabetSize);
entropy(16, 94); // ~105 bitsimport secrets, string
# secrets, never random - random is a Mersenne Twister with
# predictable state and is unsuitable for anything security-related.
alphabet = string.ascii_letters + string.digits + string.punctuation
password = "".join(secrets.choice(alphabet) for _ in range(20))
# Simpler, and 128 bits of entropy in ~22 URL-safe characters
token = secrets.token_urlsafe(16)
# A passphrase from a wordlist (EFF long list, 7776 words)
with open("eff_large_wordlist.txt") as f:
wordlist = [line.split()[1] for line in f]
passphrase = "-".join(secrets.choice(wordlist) for _ in range(6))
# ~77 bits, and far easier to type than a random string# 32 URL-safe characters from the system CSPRNG
openssl rand -base64 24 | tr -d '\n'
# Printable ASCII, 20 characters
LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^&*-_=+' < /dev/urandom | head -c 20; echo
# A six-word passphrase
shuf -n 6 --random-source=/dev/urandom /usr/share/dict/words | paste -sd-
# /dev/urandom is the right source - it is a CSPRNG. Do not
# substitute $RANDOM, which is trivially predictable.When you need this
- Creating a password for a new account, straight into a password manager.
- Generating a database or service credential for a deployment.
- Producing an API key or token that needs to be unguessable.
- Rotating a credential after a suspected exposure.
- Generating a memorable passphrase for something you must type by hand, such as a disk encryption key.
Common problems and what causes them
- Using Math.random() or a language's default PRNG
- Math.random() and Python's random module are fast pseudo-random generators with recoverable internal state - observing a few outputs can reveal the rest. Use crypto.getRandomValues or secrets. This is the difference between a real password and one that only looks random.
- Modulo bias in a hand-rolled generator
- Mapping a random byte with byte % alphabetSize makes early characters slightly more likely whenever the alphabet size does not divide 256. The effect is small but real; use rejection sampling, or a library that already does.
- Composition rules producing weaker passwords
- Requiring one of each character class pushes people to Password1! and similar, which are at the top of every cracking list. Current NIST guidance drops the requirement in favour of length, and advises against forced periodic rotation for the same reason.
- Choosing passphrase words yourself
- Human word choices cluster heavily, so a self-selected phrase has a small fraction of the entropy the word count suggests. The words have to come from a random selection over a known list for the arithmetic to hold.
- Reusing a strong password
- Strength does not survive reuse: one breached site exposes every account sharing that password, whatever its entropy. Unique passwords per site is the single highest-value habit, which is what makes a password manager necessary rather than optional.
- Storing passwords with a fast hash
- If you are on the receiving end, never store passwords with SHA-256 or MD5 - they are designed to be fast, so a leaked table is brute-forced quickly. Use bcrypt, scrypt or Argon2 with per-password salts.
- A password too long for the service
- Some systems silently truncate at 20, 32 or 72 bytes, so the extra length you generated contributes nothing. bcrypt in particular ignores everything past 72 bytes.
FAQ
- How long should a password be?
- 16 characters or more from a broad alphabet is comfortably beyond offline brute force at roughly 105 bits. Use more for a password protecting other credentials - a password manager's master password, or a disk encryption key.
- Are symbols and mixed case necessary?
- They help, but length matters more: each extra character multiplies the search space by the alphabet size. Current NIST guidance drops mandatory composition rules precisely because they produce predictable passwords while adding little entropy.
- Is a passphrase better than a random password?
- A passphrase of six or more randomly chosen words gives comparable entropy to a 12-character random string and is far easier to type and remember - genuinely better for anything you enter by hand. For everything stored in a password manager, a long random string is simpler.
- Are these passwords safe to use?
- The randomness is cryptographically secure and nothing is transmitted or logged. That said, the safest workflow is to have your password manager generate the password directly, so it never passes through a browser page at all.
- Should I change my passwords regularly?
- Not on a schedule. Forced rotation drives incrementing suffixes, which is a net loss. Change a password when there is a reason - a breach notification, a suspected exposure, a shared credential after someone leaves.
- What is entropy and how much do I need?
- It is the log base 2 of the number of equally likely passwords the generator could produce - length times log2(alphabet size). 60 bits resists casual attack; 80 is solid; 100 or more is beyond any realistic offline effort. A 16-character password from 94 characters is about 105 bits.
- How long should a generated password be?
- 16 characters or more is a reasonable default for most accounts when using a full character set; go longer for anything high-value, and prefer a passphrase-style manager-generated password where the service allows it.