Skip to main content
QuickToolsWorld

Generate Strong Random Passwords

Generate a strong, random password in one click. Choose the length and which characters to include, then copy it straight into your account or password manager.

Runs entirely in your browser. Nothing you enter is uploaded.

Estimated strengthStrong · about 103 bits

Based on the length and the characters allowed. No password is unbreakable, but longer random passwords take far more guesses to crack.

Password options

4–64 with the slider, up to 128 in the number box. 16 or more is recommended.

How to generate a password

  1. Set the length with the slider or type a number from 4 to 128.
  2. Tick the character types you want: uppercase, lowercase, numbers and symbols.
  3. Select Generate password. Changing an option creates a new password that matches it.
  4. Select Copy password and paste it where you need it, ideally into a password manager.

How this generator works

The generator first picks one character from every type you selected, so each one is always represented. It fills the remaining length from the combined pool of allowed characters, then shuffles the result with a Fisher–Yates shuffle. Every random choice comes from your browser’s cryptographically secure random number generator.

The character sets are:

  • Uppercase: ABCDEFGHIJKLMNOPQRSTUVWXYZ
  • Lowercase: abcdefghijklmnopqrstuvwxyz
  • Numbers: 0123456789
  • Symbols: !@#$%^&*()-_=+[]{};:,.?/~

Understanding password strength

With all four types enabled there are 87 possible characters, so each one adds about 6.4 bits of entropy. An 8-character password has about 52 bits, a 12-character password about 77 bits, a 16-character password about 103 bits, and a 20-character password about 129 bits. Using numbers only, the same 16 characters give just 53 bits, which shows why a varied character set and a longer length both matter.

8, 12, 16 or 20 characters: which length should you choose?

  • 8 characters: only when a website won’t accept more. It is the minimum many services allow, not a good target.
  • 12 characters: a reasonable minimum for less important accounts that also use two-factor authentication.
  • 16 characters: the default here, and the length CISA recommends as a minimum. A good choice for most accounts.
  • 20 or more: for email, banking and your password manager, or whenever you’re storing the password rather than typing it.

Use the length buttons above the slider to switch quickly. For more detail, read our guide on how to create strong passwords.

Good password habits

  • Use a different password for every account, so one leak cannot unlock the others.
  • Store passwords in a password manager rather than in notes, documents or chat messages.
  • Turn on two-factor authentication for email, banking and social media accounts.
  • Change a password promptly if a service tells you it has been involved in a data breach.

Need to share a Wi-Fi password with guests? You can turn it into a scannable code with the QR Code Generator.

Frequently asked questions

Is it safe to generate a password on a website?
This generator runs entirely in your browser. The password is created on your device with the Web Crypto API and is never sent to a server, saved or logged. It exists only on this page until you leave or generate a new one.
How random are the passwords?
Each character is chosen with crypto.getRandomValues(), the browser’s cryptographically secure random number generator. A technique called rejection sampling makes every allowed character equally likely, and the final order is shuffled with the same secure source. Math.random(), which is not designed for security, is never used.
How long should my password be?
Use at least 16 characters with all four character types for important accounts. When a site limits which symbols you can use, make the password longer instead. Length adds more strength than complexity.
What does the strength estimate mean?
It shows the approximate entropy in bits: the password length multiplied by log₂ of the number of possible characters. Each extra bit doubles the number of guesses an attacker would need on average. It applies only to randomly generated passwords. No password is unbreakable, and a strong password still needs to be kept private and unique.
Should I write my passwords down?
The safest approach is a reputable password manager, which stores every password securely so you only need to remember one strong master password. Turn on two-factor authentication wherever it is offered.

Related tools

Browse all tools

Word Counter

Count words, characters, sentences, and paragraphs instantly.

Case Converter

Transform text between uppercase, lowercase, and other common case styles.