Password Generator — Free Online Tool

What is Secure Password Generator (Random, Strength Checker, Entropy)?

Password generator creates cryptographically secure random passwords for accounts, encryption keys, API tokens. Generates: random characters (uppercase, lowercase, numbers, symbols), passphrases (memorable word combinations: 'correct-horse-battery-staple'), PIN codes (numeric only), hex keys (for encryption). Customizable: length (8-128 chars), character sets (a-z, A-Z, 0-9, !@#$%^&*), exclude ambiguous (0/O, 1/l/I), exclude similar (il1L, o0O), pronounceable (easier to type). Features: strength meter (weak/medium/strong/very strong), entropy calculation (bits of randomness: 128-bit = very strong), batch generation (100+ passwords), avoid dictionary words (no 'password123'), CSPRNG (cryptographically secure pseudo-random number generator: window.crypto, /dev/urandom).

• Cryptographically secure random: Uses CSPRNG (window.crypto.getRandomValues(), not Math.random()). True randomness from OS entropy pool. Unpredictable (can't guess next password). Secure for: encryption keys, admin passwords, tokens.
• Customizable character sets: Choose: lowercase (a-z), uppercase (A-Z), numbers (0-9), symbols (!@#$%^&*()-_=+[]{}|;:,.<>?/~). Example: uppercase + numbers only (A-Z, 0-9) = PIN code. All sets = maximum entropy.
• Strength meter: Evaluates password strength: weak (<60 bits entropy), medium (60-80), strong (80-100), very strong (>100). Factors: length, character variety, no dictionary words, no patterns (123, abc). Visual feedback (red/yellow/green).
• Passphrase generation: Diceware/EFF wordlist: 4-7 random words separated by hyphens. Example: 'correct-horse-battery-staple' (xkcd famous passphrase). Memorable (easier to type), high entropy (77 bits for 4 words). Use for master passwords.
• Exclude ambiguous characters: Option to exclude: 0/O (zero/capital O), 1/l/I (one/lowercase L/capital I), confusing symbols (`,`'). Reduces typing errors (reading password from screen). Slight entropy reduction acceptable.

Why use password generator?

Weak passwords = #1 security risk (password123, qwerty, admin). Strong random passwords = prevent hacking, credential stuffing, brute force.

• Prevent credential stuffing: Reusing passwords = credential stuffing attack (hacker uses leaked password from Site A on Site B). Unique password per site = if one leaks, others safe. Generator creates unlimited unique passwords.
• Resist brute force attacks: Short password (8 chars, lowercase only) = 26^8 = 200 billion combinations (cracked in hours). Long password (16 chars, all sets) = 6 quadrillion combinations (centuries to crack). Length + variety = security.
• Avoid dictionary attacks: Dictionary words (password, qwerty, monkey) = in hacker wordlists (cracked instantly). Random characters = not in dictionary. Generator avoids patterns (no 'password123', '123456', 'abc123').
• Meet password policies: Websites require: 8+ chars, uppercase, lowercase, number, symbol. Generator ensures compliance (no manual guessing). Example: bank requires 12+ chars + all sets → generator creates compliant password instantly.
• No human bias: Humans pick predictable passwords (names, dates, favorite words). Random generator = no bias (truly random). Can't guess based on personal info (birthday, pet name). CSPRNG = unbiased randomness.
• Secure passphrases (memorable): Random chars (aB3!xQ9$) = hard to remember/type. Passphrase (correct-horse-battery-staple) = memorable, high entropy (77 bits for 4 words). Use for master password (password manager, encryption key).

When to use password generator

Use whenever creating new password or improving weak password.

• Creating account passwords (email, social media, banking).
• Password manager master password (high entropy passphrase).
• Encryption keys (AES key, SSH key passphrase, disk encryption).
• API tokens (secure random strings for authentication).
• Admin passwords (database, server, router, admin panels).
• PIN codes (numeric passwords for cards, phones, locks).
• One-time passwords (OTP seeds, recovery codes).
• Replacing weak existing passwords (audit: password123 → strong random).

How to use password generator

Configure options, generate password, save securely.

1. Set password length: Choose length: 8-128 chars. Recommended: 12-16 chars (balance security/usability). Longer = more secure (20+ chars = very strong). Short (8 chars) ok if all character sets used.
2. Select character sets: Check boxes: lowercase (a-z), uppercase (A-Z), numbers (0-9), symbols (!@#$). More sets = higher entropy. Example: all sets → 94 possible chars → 16-char password = 104 bits entropy.
3. Configure options (optional): Exclude ambiguous (0/O, 1/l/I): reduces confusion. Exclude similar (il1L, o0O): easier to distinguish. Pronounceable: alternates consonants/vowels (easier to say, lower entropy). No repeating chars.
4. Generate password: Click Generate → see random password: aB3!xQ9$kL2&mP5@. Entropy shown: 104 bits (very strong). Strength meter: green (strong). Copy to clipboard (one-click).
5. Generate passphrase (alternative): Switch to Passphrase mode. Select word count: 4-7 words. Word separator: hyphen (-), space, underscore. Generate: 'correct-horse-battery-staple'. Entropy: 77 bits (4 words from 7776-word list).
6. Verify strength: Check strength meter: red (weak, <60 bits), yellow (medium, 60-80 bits), green (strong, 80-100 bits), dark green (very strong, >100 bits). If weak, increase length or add character sets.
7. Save password securely: Copy to password manager (1Password, Bitwarden, LastPass). Or write down on paper (physical security). Never save in plain text file, email, browser notes. Use password manager for all passwords.

Key features

• CSPRNG (cryptographically secure): Uses window.crypto.getRandomValues() (browser), crypto.randomBytes() (Node.js), /dev/urandom (Linux). Not Math.random() (predictable, insecure). True randomness from OS entropy pool.
• Customizable length and sets: Length: 8-128 chars. Character sets: a-z (26), A-Z (26), 0-9 (10), symbols (32). Example: 16 chars, all sets → 94^16 = 6.1e31 combinations (104 bits entropy).
• Passphrase generator: Diceware/EFF wordlist (7776 words). 4 words → 77 bits entropy (7776^4). 5 words → 96 bits. 6 words → 115 bits (stronger than 16-char random). Memorable, typeable. Use for master passwords.
• Strength meter: Real-time evaluation: length, character variety, no dictionary words, no patterns. Entropy calculation: log2(possible_chars ^ length). Visual indicator: red (weak), yellow (medium), green (strong). Suggestions: add length, add symbols.
• Batch generation: Generate 100+ passwords at once. CSV export: password, entropy, strength. Use for: pre-generate tokens, create multiple accounts, test password policies. All unique (CSPRNG guarantees).
• Exclude ambiguous/similar: Ambiguous: 0/O, 1/l/I (confusing when reading). Similar: il1L, o0O (hard to distinguish). Option to exclude (reduces entropy slightly, increases usability). Use for passwords typed manually (not copy-paste).
• Copy to clipboard: One-click copy (secure: clipboard cleared after 30s on some tools). Or show QR code (scan with phone). Download as .txt (encrypted file). Never display in URL (security risk).

Common use cases

• Account passwords (email, social media): Generate unique password for each account. Example: Gmail → aB3!xQ9$kL2&mP5@ (16 chars, 104 bits). Facebook → different password. Store in password manager (never reuse).
• Master password (password manager): Passphrase for 1Password, Bitwarden master. Example: 'correct-horse-battery-staple-purple-monkey' (5 words, 96 bits). Memorable (no password manager for this one). Write on paper (safe place).
• Encryption keys (AES, SSH): Generate 256-bit key: 64 hex chars (0-9, a-f). Example: a1b2c3d4e5f6...64 chars. Use for AES-256 encryption, SSH passphrase, disk encryption. Maximum security.
• API tokens (authentication): 32-char random string (a-z, A-Z, 0-9). Example: aBcDeFgHiJkLmNoPqRsTuVwXyZ123456. Use in API headers (Authorization: Bearer <token>). Unique per user/app.
• Admin passwords (database, server): Database root password: 20+ chars, all sets. Example: aB3!xQ9$kL2&mP5@nR8#tV1% (24 chars, 156 bits). Critical security (server compromise if weak). Never use default (admin/admin).
• PIN codes (numeric): 6-digit PIN: 123456 (weak) vs 849203 (random, better). 4-digit PIN: 10,000 combinations (weak, ok for phone unlock). Use random generator (avoid 0000, 1234, 1111).

Examples

Password generation examples with entropy calculations.

Length: 16, Sets: a-z, A-Z, 0-9, symbols

Password: aB3!xQ9$kL2&mP5@
Entropy: log2(94^16) = 104.2 bits
Strength: Very Strong
Brute force time: Billions of years

Words: 5, Separator: hyphen, Wordlist: EFF (7776 words)

Passphrase: correct-horse-battery-staple-purple
Entropy: log2(7776^5) = 64.6 bits
Strength: Medium-Strong
Memorable: Yes

Length: 32, Sets: a-z, A-Z, 0-9 (no symbols)

Token: aBcDeFgHiJkLmNoPqRsTuVwXyZ123456
Entropy: log2(62^32) = 190.5 bits
Strength: Very Strong
Use: API authentication

Length: 6, Sets: 0-9 only

PIN: 849203
Entropy: log2(10^6) = 19.9 bits
Strength: Weak
Combinations: 1 million

Length: 64, Sets: 0-9, a-f (hex)

Key: a1b2c3d4e5f6...64 chars
Entropy: 256 bits (64 hex × 4 bits/hex)
Strength: Very Strong
Use: AES-256 encryption

Technical reference

Password security specifications and entropy calculations:

Entropy formula

Entropy (bits) = log2(possible_chars ^ length). Example: 16 chars, 94 possible (a-z, A-Z, 0-9, symbols) → log2(94^16) = 104.2 bits. 128 bits = very strong (AES-128 equivalent).

Character set sizes

Lowercase (a-z): 26 chars. Uppercase (A-Z): 26 chars. Digits (0-9): 10 chars. Symbols (!@#$...): ~32 chars. All combined: 94 chars. More sets = higher entropy per character.

Recommended lengths

Minimum: 12 chars (all sets). Strong: 16 chars. Very strong: 20+ chars. Passphrase: 4+ words (77+ bits). Master password: 5+ words (96+ bits). API token: 32+ chars.

Strength levels

Weak (<60 bits): easily cracked. Medium (60-80 bits): ok for low-value accounts. Strong (80-100 bits): good for most accounts. Very strong (>100 bits): critical accounts (banking, master password).

Passphrase entropy

Diceware wordlist: 7776 words (log2(7776) = 12.9 bits per word). 4 words: 51.6 bits (weak). 5 words: 64.6 bits (medium). 6 words: 77.5 bits (strong). 7 words: 90.4 bits (very strong). EFF wordlist similar.

CSPRNG sources

Browser: window.crypto.getRandomValues() (Web Crypto API). Node.js: crypto.randomBytes() (OpenSSL). Linux: /dev/urandom (kernel entropy pool). NOT Math.random() (predictable, insecure for passwords).

Brute force time

8 chars, lowercase only (26^8 = 208 billion): hours on GPU. 12 chars, all sets (94^12 = 4.8e23): millions of years. 16 chars, all sets (94^16 = 6.1e31): billions of years (with current tech).

Exclude ambiguous impact

Excluding 0/O, 1/l/I reduces character set: 94 → ~88 chars. Entropy reduction: log2(88^16) / log2(94^16) = 103 / 104 bits (1% loss). Acceptable for usability gain (easier to read).

Password policies

Common requirements: 8+ chars, uppercase, lowercase, number, symbol. Some require: no dictionary words, no repeating chars, no username. Generator can meet all (customize settings).

Storage recommendations

Password manager (encrypted vault): 1Password, Bitwarden, LastPass. Master password: memorize (passphrase) or write on paper (secure location). Never: plain text file, email, browser notes, Slack/Discord.

Common mistakes to avoid

Using Math.random() instead of crypto.getRandomValues() (not secure)

Why it happens: Math.random() = pseudo-random (predictable seed, can be cracked). Not cryptographically secure (attacker can predict next values). Passwords generated with Math.random() = weak (vulnerable to prediction attacks).

How to avoid it: Use CSPRNG: window.crypto.getRandomValues() (browser), crypto.randomBytes() (Node.js), /dev/urandom (Linux). True randomness from OS entropy pool. Unpredictable, secure.

Short passwords (8 chars) with limited character sets (lowercase only)

Why it happens: 8 chars, lowercase only (26^8 = 208 billion combinations) = cracked in hours on GPU. Length + variety = security. Short + limited = weak.

How to avoid it: Minimum: 12 chars with all sets (a-z, A-Z, 0-9, symbols). Recommended: 16 chars. Critical accounts: 20+ chars or 5+ word passphrase. More length > more complexity.

Reusing passwords across accounts (credential stuffing risk)

Why it happens: Password leaked from Site A (data breach) → hacker tries on Site B (credential stuffing). Reused password = all accounts compromised. Single breach = domino effect.

How to avoid it: Unique password per account. Use password manager (generates + stores unique passwords). Generator creates unlimited unique passwords. Never reuse.

Excluding too many characters (low entropy)

Why it happens: Excluding ambiguous (0/O, 1/l/I) + similar (il1L, o0O) + symbols (for simplicity) = 26 lowercase + 20 uppercase + 8 digits = 54 chars. 16-char password = log2(54^16) = 93 bits (vs 104 with all 94). Significant entropy loss.

How to avoid it: Exclude ambiguous only if manually typing (reduces errors). Keep symbols (high entropy). Use copy-paste (no need to exclude anything). Accept slight entropy loss for usability if needed.

Not using password manager (forget passwords, write on insecure notes)

Why it happens: Random passwords = impossible to remember (aB3!xQ9$kL2&mP5@). Users write on sticky notes, plain text files (insecure). Or reset password every time (annoying).

How to avoid it: Use password manager: 1Password, Bitwarden, LastPass (encrypted vault). Generate + store all passwords. Remember one master password (passphrase). Sync across devices.

Frequently asked questions

How long should my password be?

Minimum: 12 chars (all sets). Recommended: 16 chars. Critical accounts (banking, email, master password): 20+ chars or 5+ word passphrase. More length = exponentially more security.

Are passphrases more secure than random characters?

Depends on length. 4-word passphrase (correct-horse-battery-staple) = 52 bits (weak). 5 words = 65 bits (medium). 6 words = 77 bits (strong). 16-char random (all sets) = 104 bits (stronger). Passphrases: memorable. Random: max security.

Should I exclude ambiguous characters (0/O, 1/l/I)?

If typing manually: yes (reduces errors). If copy-pasting: no (keep all for max entropy). Excluding reduces entropy slightly (104 → 103 bits, negligible). Usability vs security tradeoff.

Is it safe to use online password generators?

Reputable tools: yes (if using window.crypto, client-side generation, no logging). Check: HTTPS, open-source, no server upload. Best: offline tool or browser extension (no network = no leak risk).

How often should I change my password?

Only if: compromised (data breach, suspected leak), shared with someone, weak (upgrade to strong). No need to change strong unique password regularly (NIST guidelines 2017: periodic change = users pick weaker passwords).

Can hackers crack my 16-character password?

16 chars, all sets (94 chars) = 6.1e31 combinations (104 bits). Brute force: billions of years (with current tech). Quantum computers (future): threat to <128 bits. 16 chars = safe for foreseeable future. 20+ chars = quantum-resistant.

What is entropy and how much do I need?

Entropy = bits of randomness (log2(combinations)). 60 bits = medium. 80 bits = strong. 100+ bits = very strong. 128 bits = AES-128 (military grade). Recommendation: 80+ bits for most accounts, 100+ for critical.

References

• NIST Password Guidelines
• Diceware Passphrase
• EFF Wordlist
• Web Crypto API