How to use this calculator
- Choose a length (16 or more characters is recommended).
- Choose which character types to include. At least one character of each selected type is guaranteed.
- Optionally avoid look-alike characters (I, l, 1, O, 0, o) for passwords you'll type by hand.
- Copy the password into your password manager.
Formula
Password strength is measured as entropy: how many guesses an attacker would need on average. Each character drawn uniformly from a pool of N symbols adds log₂(N) bits.
Entropy = length × log₂(pool size)
20 characters from 88 symbols ≈ 129 bits
Frequently asked questions
Is this generator secure?
Yes. It uses the Web Crypto API (crypto.getRandomValues) with rejection sampling to avoid bias. Everything runs locally; the password never leaves your device.
How long should a password be?
Current guidance (such as NIST SP 800-63B) favours length. For accounts protected by a password manager, 16–20+ random characters is excellent.
Should I reuse passwords?
Never. Use a unique password for every account, store them in a password manager, and turn on two-factor authentication where available.