Password Generator
Generate strong, secure passwords with customizable options. Choose length, uppercase, lowercase, numbers, and symbols. All processing happens locally in your browser - no data is sent to any server.
••••••••••••••••Generate strong, secure passwords with customizable options. All processing happens locally in your browser - no data is sent to any server.
How to generate a strong password
Pick a length, keep the character types on, and save the result in a password manager.
- 01
Set the length first
The slider runs from 4 to 64 characters and starts at 16. Length matters more than anything else, so go as long as the site allows: 16 for everyday accounts, 20 or more for email, banking and your password manager's master password.
- 02
Leave all four character types on unless a site objects
Uppercase, lowercase, digits and symbols give 88 possible characters per position. Every type you switch on is guaranteed to appear at least once, which keeps sites with "must contain a number and a symbol" rules happy.
- 03
Copy it straight into a password manager
The password is hidden by default; the eye icon shows it. Copy and paste it into Bitwarden, 1Password or your browser's manager, and save it before you close the tab.
How the password is picked
Each character is chosen with crypto.getRandomValues, the browser's cryptographic random number generator, the same source used for encryption keys. Random bytes that would make some characters slightly more likely than others are thrown away and redrawn, so every character in the set has exactly the same chance.
If the result is missing one of the types you switched on, the whole password is drawn again. Without that check, a 16-character password with all four types on would lack at least one type about 15.6% of the time, mostly digits, since there are only 10 of them.
How strong each setting really is
Strength is best measured in bits of entropy: length × log₂(characters available). Each extra bit doubles the number of guesses an attacker needs. The table shows bits for common choices.
| Characters allowed | 12 chars | 16 chars | 20 chars | 32 chars |
|---|---|---|---|---|
| Lowercase only (26) | 56 | 75 | 94 | 150 |
| Upper and lowercase (52) | 68 | 91 | 114 | 182 |
| Letters and digits (62) | 71 | 95 | 119 | 191 |
| All four types (88) | 78 | 103 | 129 | 207 |
Two things stand out. A 20-character lowercase password (94 bits) beats a 12-character one with every type switched on (78 bits), which is why length comes first. And anything above roughly 100 bits is far beyond brute force with any hardware that exists today. The strength bar in the tool is a simpler score based on length and which types appear, so treat the bits here as the better guide.
Where a random password matters
Replacing a reused password
If one password guards several accounts, a single breach exposes them all. Generate a new one per site, starting with email and banking.
Wi-Fi and router admin passwords
A 20-character password is fine here because you type it once per device. Switch symbols off if a smart TV's keyboard makes them painful.
Database and service accounts
Use 32 characters or more for credentials only software will use. Switch symbols off if the connection string treats characters such as @ or : specially.
Mistakes that undo a strong password
Reuse is the big one. A perfect password used on two sites is only as safe as the weaker site's database. Writing it in a plain notes file or emailing it to yourself is next, because those places get synced, searched and sometimes breached.
Short PINs are a separate case. A 4-digit code has only 10,000 combinations, about 13 bits, so it relies entirely on lockouts after a few wrong tries. Use the 4-character minimum only where a service forces a PIN, and switch on two-factor authentication wherever it's offered, since that protects you even if a password leaks.