Random Password Generator

How to Use the Random Password Generator

Set your password length. The default is 16 characters. Most security experts recommend a minimum of 12. Longer is better. Set it to 20 or more for high-value accounts.

Choose your character types. Toggle uppercase letters, lowercase letters, numbers, and symbols on or off. All 4 are on by default. Leaving all 4 on produces the strongest passwords.

Click Generate. The tool creates a password instantly. Copy it with one click. Paste it into your password manager.

Click Generate again for a different password. Each click is independent. No two passwords share a pattern.

What Makes a Strong Password

Password strength comes from two factors: length and entropy.

Length is how many characters the password contains. Every additional character multiplies the number of possible combinations. A 12-character password has vastly more possible combinations than an 8-character password. A 20-character password is exponentially harder to crack than a 12-character one.

Entropy is unpredictability. A password made of all lowercase letters from the 26-character alphabet has lower entropy than a password that mixes uppercase letters, lowercase letters, numbers, and symbols from a pool of 94 characters.

A 16-character password using all 4 character types has 94 to the power of 16 possible combinations. That is a number with 31 digits. At a rate of 1 billion guesses per second, cracking it by brute force would take longer than the current age of the universe.

This tool generates passwords using crypto.getRandomValues(). Each character is selected from the pool with equal probability. There is no pattern, no seeding from predictable values, and no way to predict the next password from the previous one.

How Password Cracking Actually Works

Brute force. The attacker tries every possible combination. This is impractical against long passwords but becomes feasible against short ones. An 8-character all-lowercase password has about 208 billion combinations. Modern GPUs can test that in a few hours.

Dictionary attacks. The attacker tries common words, names, and phrases first. "Password", "qwerty", "123456", and millions of variations are in every dictionary attack list. Any password that consists of real words is vulnerable regardless of length.

Credential stuffing. The attacker uses passwords from previous data breaches. If you reuse the same password across sites, one breach exposes every account. Unique passwords for every site is the single most important password habit.

Phishing. The attacker tricks you into typing your password into a fake site. No password strength protects against this. This is why a password manager matters — it will not autofill on a fake site because the domain does not match.

A randomly generated password with 16 or more characters, used uniquely on each site, and stored in a password manager, eliminates vulnerability to the first 3 attack types entirely.

Password Manager Basics

Generated passwords are only useful if you can retrieve them later. Memorizing a 20-character random string is not realistic. A password manager solves this.

A password manager stores your passwords in an encrypted vault. You unlock it with one strong master password. Every other password can be as long and random as you want because you never have to type or remember them.

Well-regarded password managers include Bitwarden (free and open source), 1Password, and Dashlane. All three work across Windows, Mac, iOS, and Android. The most important thing is to use any password manager consistently. The specific product matters less than the habit.

Passphrase vs Random Password

A passphrase uses several random words strung together. An example might be: PurpleTruckSandwichRiver. That is 24 characters, easy to remember, and contains high entropy from the combination of 4 unrelated words.

A random character password like mXv@9Kp2#nR7qWzL is harder to remember but contains more entropy per character because it draws from a 94-character pool instead of a word list.

For accounts you access frequently and might need to type manually, a passphrase works well. Use the Random Word Generator to generate 4 or 5 unrelated words, then combine them with a number or symbol.

For accounts you access through a password manager and never type manually, a random character password at 20 characters or longer is the strongest option.

Tips for Better Password Hygiene

Generate a unique password for every account. Never reuse passwords. One breach exposes every account that shares that password.

Use a minimum of 16 characters for any account that holds financial, medical, or personal data.

Enable two-factor authentication on every account that supports it. A strong password plus 2FA makes unauthorized access nearly impossible.

Change passwords when a service you use reports a data breach. You can check if your email has appeared in known breaches at haveibeenpwned.com.

Do not email yourself passwords. Email is not encrypted at rest on most providers. Use a password manager instead.

Need a numeric PIN? Use the Random Number Generator with a range like 100000 to 999999 for a 6-digit PIN.