Password Generator

How the passwords are made

Randomness comes from crypto.getRandomValues, never Math.random. Random values that would make some characters slightly more likely than others are thrown away (this avoids modulo bias), so every character in the pool has the same chance.

The generator picks one character from each ticked set, fills the rest from all ticked sets combined, then shuffles. The 27 symbols are ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > ? / ~. The one-per-set rule costs a little entropy (about 0.14 bits at length 20), which the Strength line doesn't subtract.

Entropy and time to crack

For a random password, entropy in bits = length × log2(pool size). All four sets give a pool of 89 characters, or 6.48 bits per character. Letters and digits give 62 (5.95 bits), and digits alone give 10 (3.32 bits). Every extra bit doubles an attacker's work.

Here's how long it takes to try every combination at 100 billion guesses per second, about what one high-end gaming GPU does against MD5 hashes. Online attacks against a login form are millions of times slower, but leaked password databases get attacked offline like this.

• 8 lowercase letters (38 bits): about 2 seconds.
• 8 characters, all four sets (52 bits): about 11 hours.
• 12 letters and digits (71 bits): about 1,000 years.
• 12 characters, all four sets (78 bits): about 78,000 years.
• 16 characters, all four sets (104 bits): about 5 trillion years.

Length beats complexity

A 20-character password of only lowercase letters has about 94 bits. A 12-character one with all four sets has about 78. More characters help more than more character types, and they're easier to type.

NIST SP 800-63B (revision 4, 2025), the US guideline many companies worldwide follow, tells services to:

• require at least 15 characters for password-only logins, and 8 with a second factor;
• accept passwords of at least 64 characters, including spaces and Unicode;
• drop character-type rules and scheduled changes, but force a change after a compromise;
• check new passwords against lists of common and breached passwords;
• allow password managers, autofill and paste.

Symbols that break config files and URLs

Passwords for databases, queues and API clients end up in places where some symbols have a meaning. A password containing @, :, / or # breaks a URL like postgres://app:PASSWORD@db.example.com:5432/shop unless you percent-encode it with the URL Encoder. In many .env loaders an unquoted # starts a comment, and Docker Compose treats $ as the start of a variable. In a shell, $ and backticks inside double quotes are expanded. In YAML, a value that starts with *, &, !, [ or { needs quotes.

For secrets that machines read, untick Symbols and add length instead. 32 letters and digits give about 191 bits, far more than any attacker can search, with nothing to escape.

Passphrases, password managers and reuse

For the few passwords you must remember, like a password manager's master password, a passphrase is easier. Six words rolled with dice from a 7,776-word list (the Diceware method) give about 77.5 bits, as long as dice pick the words and you don't. This page makes random-character passwords only.

For everything else, let a password manager store a different password for each site. Reuse turns one breach into many, because attackers try leaked email and password pairs on other services. To send a password to a colleague, encrypt it with AES and share the passphrase another way.

If you're building a login system, store passwords with Argon2id, scrypt or bcrypt. A fast hash like the SHA-256 from the Hash Generator is the wrong tool for that.

Generate a password in code

Use a cryptographic random source: secrets in Python, node:crypto in Node.js, crypto.getRandomValues in the browser. Python's random module and JavaScript's Math.random() are predictable and don't belong anywhere near a password.

openssl rand -base64 24
# A7myeuEF9UI8taj0aYSbmdk5jf3ehyeY  (32 characters, 192 bits)

import secrets, string

alphabet = string.ascii_letters + string.digits + string.punctuation
password = "".join(secrets.choice(alphabet) for _ in range(20))

const { randomInt } = require("node:crypto");

const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*";
const password = Array.from({ length: 20 }, () => chars[randomInt(chars.length)]).join("");