random · 94 characters · bits
Password generator
A 16-character password drawn from all 94 printable ASCII characters carries 104.9 bits of entropy, and this page makes one in your browser tab. Pick characters or words, set the length and copy the result.
- 10 × 0–9 = 33.2 bit
- 16 × log₂ 94 = 104.9 bit
- 6 × log₂ 1296 = 62.0 bit
A new value appears each time you change a setting or press Regenerate. Nothing you generate is stored, put in the address or sent to a server.
Scanned by 
NortonTM Safe Web
At a glance
- Price
- No charge
- Account
- None needed
- Upload
- Not applicable — values are made in your tab, nothing is sent anywhere
- Random source
- crypto.getRandomValues of your browser, with rejection sampling
- Length
- 4 to 128 characters, or 3 to 12 words
- Word list
- EFF Short Wordlist #1, 1296 words, CC BY 3.0 US
Entropy of common settings
Entropy is length × log2(pool size), in bits. A pool of 10 is digits, 26 is lowercase letters, 62 is letters and digits and 94 is every printable ASCII character. Each added bit doubles the number of guesses a method needs.
| Pool size | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|
| 10 | 26.6 | 39.9 | 53.2 | 66.4 |
| 26 | 37.6 | 56.4 | 75.2 | 94.0 |
| 62 | 47.6 | 71.5 | 95.3 | 119.1 |
| 94 | 52.4 | 78.7 | 104.9 | 131.1 |
| Words | Entropy (bits) |
|---|---|
| 3 | 31.0 |
| 4 | 41.4 |
| 5 | 51.7 |
| 6 | 62.0 |
| 7 | 72.4 |
How to make a password
Choose characters or words
Characters gives a short string such as a password manager would store. Passphrase joins random words from a list of 1296, which is easier to read and to type on a phone or a television.
Set the length and the types
The default is 16 characters from lowercase, uppercase, digits and symbols. Length matters most: each extra character from a pool of 94 adds 6.55 bits. Turn a type off if the site you sign up to refuses it.
Copy it and store it
Press Copy and paste the value into the sign-up form and into your password manager at once. The page keeps no history, so a value you do not copy is gone when you leave or press Regenerate.
How the passwords are made
The page asks the browser's cryptographic random number generator, crypto.getRandomValues, for numbers and turns each one into a position in the list of characters or words. A plain remainder would favour some positions, so numbers from the top of the range that do not fill a whole round are discarded and drawn again. With the option to include one of each type, a password that misses a type is thrown away and drawn again instead of placing a digit or a symbol at a fixed position, so no position is predictable.
The entropy figure is length × log2(pool size) for characters and words × log2(1296) for words, which is about 10.34 bits per word. It describes the method when every choice is random, not a rating of a password a person made up. A generator cannot protect a password that a site stores badly, that you type into a page that imitates the site, or that you reuse elsewhere. The word list is the EFF Short Wordlist #1 by the Electronic Frontier Foundation, published under Creative Commons Attribution 3.0 US, from eff.org/dice. It loads only when you switch to Passphrase.
Password questions
How long should a password be?
Choose at least 16 characters for an account that matters, and 12 as a floor. From all 94 printable characters, 12 characters give 78.7 bits, 16 give 104.9 bits and 20 give 131.1 bits. Each added bit doubles the number of guesses the method needs, so each added character from a pool of 94 multiplies it by about 94.
Do symbols make a password stronger than length does?
Length adds more than a larger pool. Going from 62 characters (letters and digits) to 94 (adding symbols) adds 0.60 bits per character, while one more character adds 5.95 bits from a pool of 62. A 16-character password from 62 characters has 95.3 bits, more than 78.7 bits for 12 characters that include symbols. NIST SP 800-63B, the US guidance on digital identity, advises against rules that force mixed character types and asks sites to accept at least 64 characters.
When is a passphrase better than a random password?
A passphrase is better when you must read it, say it or type it by hand: a Wi-Fi password, a device sign-in or the master password of a password manager. Each word adds about 10.34 bits, so 4 words give 41.4 bits, 6 words give 62.0 bits and 8 words give 82.7 bits. To match 104.9 bits you need 11 words; a random string of 16 characters is shorter for the same figure.
Is the password sent or stored anywhere?
No. The value is made in your browser tab by the browser's own random number generator and shown on the page. The page writes nothing to cookies, local storage, the address bar or a server, and keeps no history. Pressing Regenerate or closing the tab discards the value.
What does entropy in bits mean?
Entropy in bits is the base-2 logarithm of the number of equally likely results a method can produce. A password of 10 random digits has 10 × log2(10) = 33.2 bits, which is 10 billion possibilities. Adding one bit doubles the number of possibilities. The figure applies to a value made by random choice, as here; it says nothing about a password that a person invented.
Why use a password manager and not reuse a password?
A manager stores one long random password per site, so you only remember its own master password. A reused password is only as safe as the weakest site that holds it: when one site loses its password data, the same password works on every other site where you used it. A unique random value for each account limits the damage to that one account.