Secure password generator
Random passwords with calculated entropy, generated in your browser.
Calculator inputs
Results
Enter your values and press “Calculate” to see the result.
In short
- What it calculates
- Random passwords with calculated entropy, generated in your browser.
- Formula used
Entropy = length × log₂(alphabet size)- Example
- With 16 characters, uppercase, lowercase and digits:
Secure password generator
A strong password is not one that looks complicated, but one that is impossible to guess. That is measured in entropy: how many bits of uncertainty it offers against brute force.
The password is generated with your browser's cryptographic generator and never travels to a server.
How it works
An alphabet is built from the character types you select, leaving out the ones easily confused by eye (l, 1, I, O, 0), and characters are drawn at random with cryptographic randomness.
Formula
Entropy = length × log₂(alphabet size)
16 characters over a 60-character alphabet ≈ 94 bits
Worked example
With 16 characters, uppercase, lowercase and digits:
Alphabet of 59 characters
Entropy: about 94 bits, rated excellent
Explanation
Length beats complexity
For years the advice was to mix uppercase, numbers and symbols into eight characters. Today's reference guidance, starting with the American NIST, prioritises length: a long passphrase of ordinary words holds up better than a short, unmemorable jumble. Twelve random characters is already reasonable; sixteen or more is comfortable for years.
What makes a password weak
Not the absence of symbols, but predictability. Replacing an a with an at sign or adding a 1 at the end fools no attacker, because those transformations are in every cracking dictionary. A randomly generated twelve-character password is orders of magnitude stronger than 'Password2024!'.
Reuse is the real problem
Most unauthorised access does not come from cracking a password, but from reusing one already exposed elsewhere. A different password per service, kept in a manager, solves more than any complexity requirement.
Two-factor matters more than length
Turning on two-step verification protects you even if the password leaks. It is the single measure with the best ratio of effort to security gained.
Frequently asked questions
Is the generated password stored?
No. It is created in your browser and neither sent nor saved anywhere. Reloading the page discards it.
How many bits of entropy do I need?
Above 70 bits is solid for everyday accounts; from 90 bits it is excellent even against large-scale attacks.
Is a long phrase better than odd symbols?
A long random phrase. Length gives more resistance than complexity, and it is easier to handle.
How often should I change my password?
Current guidance does not recommend routine changes without cause, because they lead to predictable variations. Change it if you suspect a leak.
Need to calculate something else?
These tools are often used alongside this calculator.
Base64
Turn text into Base64 and recover the original text.
Base converter
Convert numbers between bases 2, 8, 10, 16, 32 and 36.
Timestamp
Convert between Unix timestamps and readable UTC dates.