Password Generator
Generate strong random passwords with custom length, character sets and entropy in bits, plus estimated offline crack time.
Entropy
103.1 bits
16 chars × log₂(87)
Character pool
87 symbols
From the selected character sets
Crack time
34 trillion years
Offline brute force @ 1e+10 guesses/sec
Uses the browser's cryptographically secure random number generator. The password never leaves your device.
How it works
Random selection from the enabled character pools using crypto.getRandomValues. Strength scored on length, case, digits and symbols.
Example: 16 chars with all pools → ~10³¹ combinations (88¹⁶).
Last updated: May 2026
How this calculator is verified
Checked by Rahim Virani on
- Character-class inclusion guarantees at least one character from each selected set
- Cryptographically secure RNG used rather than Math.random
- Ambiguous characters excluded only when the toggle is enabled
The full verification method is on our how we verify page. Found an error? Tell us and we will re-check it.
When to Use This Calculator
Weak passwords are a leading cause of account takeovers in India, where one reused password can expose email, UPI and social media at once. This generator creates strong random passwords of any length using uppercase, lowercase, digits and symbols, and it runs entirely in the browser so nothing is sent over the network. Students use it to secure campus portals and Wi-Fi accounts, freelancers generate unique passwords for each client dashboard, and small business owners protect their GST portal and net-banking logins. The strength label gives instant feedback, and the 16-character default carries enough entropy to defeat practical brute-force attempts. Pair each generated password with a password manager and use a different one for every account — that single habit prevents most account-compromise incidents.
How to Use This Calculator
- Step 1: Set the length with the slider or number field — 16 characters is a sensible default for most accounts.
- Step 2: Tick the character sets you want: uppercase, lowercase, digits and symbols.
- Step 3: Press generate and review the password shown, along with its strength label.
- Step 4: Copy it and store it in a password manager; regenerate a new one for each site rather than reusing the same output.
Worked Example
Open the generator, choose a length of 16 characters and tick all four sets — uppercase, lowercase, digits and symbols. The combined pool has 88 possible characters, so a 16-character password carries about 103 bits of entropy, far beyond what a brute-force attempt can realistically cover. The generator runs entirely in the browser using the device's random source, so the password is never sent to a server. Copy the result into your password manager, and generate a fresh one for every online account instead of reusing an old favourite.
Tips and Common Mistakes
- •Tip 1: Use a password manager to store generated passwords — the generator can only create them, not remember them for you.
- •Tip 2: Longer beats complex: a 20-character passphrase-like random string is stronger than a short one with many symbols.
- •Tip 3: Check the strength label after generation; if a long password still reads weak, one of the character sets is probably missing.
- ✗Mistake 1: Reusing the same generated password across sites — one leak then compromises every account that shares it.
- ✗Mistake 2: Shortening the length to make it easier to type; 8 characters from a reduced set can fall within practical brute-force range.
Frequently Asked Questions
How strong should my password be?
Use at least 12 characters mixing upper and lower case, digits and symbols. A 16-character random password with all character types is effectively uncrackable by brute force.
Should I use a password manager?
Yes. A password manager lets you use a unique strong password for every site without memorising them. The generated password here is safe to store in one.
Are generated passwords random?
Yes — the generator uses the browser's cryptographically secure random number generator (crypto.getRandomValues), not a predictable algorithm.
Why shouldn't I reuse the same password on multiple sites?
If one site leaks its database, attackers try those same credentials on banks and email accounts. A unique password per site contains the damage.
You might also need
Related calculators from other categories