Password Generator
Create a strong password with the character sets you need and see how much entropy it actually has. Values come from the browser's cryptographic random generator and never leave your device.
Password
…
Entropy: 129 bits · excellent
About this tool
Password strength is measured in bits of entropy: how many guesses an attacker needs on average. Length matters far more than complexity — a 20-character password from lowercase letters alone beats an 8-character password using every symbol on the keyboard.
Aim for at least 75 bits for ordinary accounts and 100 bits or more for password managers, encryption keys and administrator accounts. Because a generated password is impossible to memorise, store it in a password manager rather than reusing it.
Frequently asked questions
- How long should a password be?
- At least 16 characters for everyday accounts and 20 or more for anything valuable. Length is the single most effective defence against brute-force attacks.
- Is the generated password sent anywhere?
- No. It is created in your browser using `crypto.getRandomValues` and never transmitted, logged or stored.
- What does the entropy score mean?
- It estimates how many bits of randomness the password contains. Each extra bit doubles the number of guesses an attacker needs; 75 bits is strong and 100+ bits is excellent.
- Should I exclude look-alike characters?
- Enable that option when the password will be read aloud or typed from paper, so 1/l/I and 0/O are not confused. It slightly reduces entropy, so add a couple of characters to compensate.
- Are symbols really necessary?
- They help, but adding four more characters increases strength more than adding symbols to a short password. Some systems also reject certain symbols, so length is the more reliable lever.