Password Generator
Generate strong random passwords instantly.
Was this tool helpful?
Thanks for the feedback!
The Password Generator gives you one random 16-character password each time you click Generate passwords, always containing at least one capital letter, one small letter, one digit and one symbol. Use it when you open a new account or replace a password you have used on more than one site. The password is produced in your browser by its cryptographic random number generator and is not sent to the site.
What each click produces
There are no settings to adjust: every result is exactly 16 characters long, drawn from a pool of 87.
- 26 capitals, A to Z
- 26 small letters, a to z
- 10 digits, 0 to 9
- 25 symbols:
! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > ?
Each character is picked with crypto.getRandomValues, the browser's secure random source, rather than the predictable Math.random used for games and animations. If a draw happens to miss one of the four character types, it is thrown away and drawn again, so every result passes the usual "capital, small letter, number and symbol" rule. Three runs during testing gave a-=#!Qf34By_{);8, SpA@87z3>rQK4Wp- and +v%1Uc}pL#N={]p8. Press Copy result and paste the password straight into the sign-up form and your password manager.
How strong is a 16-character random password?
Strength comes from how many possible passwords an attacker would have to try. With 87 choices per position, each character adds about 6.44 bits of entropy (log₂ 87). Sixteen characters allow about 1.1 × 10^31 strings; requiring all four types rules out roughly 15% of them, which leaves about 9.1 × 10^30 possible passwords, or close to 103 bits.
| Password | Possible combinations | Time to try all at 10^12 guesses a second |
|---|---|---|
| 8 characters, small letters and digits only | 2.8 × 10^12 | about 3 seconds |
| 8 characters from this tool's pool | 3.3 × 10^15 | about 55 minutes |
| 16 characters from this tool, all four types | 9.1 × 10^30 | about 290 billion years |
A trillion guesses a second is a generous figure, the sort of rate a cracking rig might reach against a stolen database protected by a fast, weak hash. Even then, the 16-character password would outlast the 13.8-billion-year age of the universe about 21 times over. The table only holds for passwords chosen at random. Something like Priya@1998 has ten characters but is guessed far sooner, because cracking tools try names, dates and keyboard patterns long before random strings.
What current NIST guidance says
The US National Institute of Standards and Technology finalised SP 800-63B-4 in July 2025. It is written for organisations that check passwords, but it shows where expert thinking now stands:
- A password used on its own should be at least 15 characters; 8 is the floor only when it is one part of a multi-factor login.
- Services should accept passwords of at least 64 characters, allow pasting and work with password managers.
- They should not force mixtures such as "one capital and one symbol", and should not make you change passwords on a schedule, only when there is evidence of compromise.
- New passwords should be checked against lists of common and breached passwords.
A 16-character output from this tool clears the 15-character floor. Many banking and government sites still insist on character mixes, which the guaranteed mix already satisfies, and some add length caps or symbol bans, which is where the tips below come in.
Tips and common mistakes
- Length caps. If a site allows at most 14 characters, deleting the last two leaves a password that is still random, just shorter. Check that the shortened version still has a digit and a symbol if the site asks for them, because one of those may have been among the deleted characters.
- Banned symbols. Some sites refuse characters such as < or >. Swap the refused character for another allowed symbol, so the mix of types stays intact.
- Save it before you leave. The page keeps no record, so store the password in a password manager the moment you set it, not in a notes app or a chat with yourself.
- One password per account. Start with your email, because every other account's "forgot password" link leads there.
- Never reuse the examples above. Anything printed on a web page should be treated as known to attackers.
- Add two-factor authentication wherever it is offered, so a leaked password alone is not enough to get in.
To rate a password you already use, try the password strength checker. For a numeric code such as a locker or app PIN, the PIN generator is the better fit.
Limits
You get one password per click, always 16 characters, always from the same pool. You cannot leave out look-alike characters such as O and 0 or l and 1, which matters if you need to read a password aloud or type it from paper. For something you must type from memory, such as a laptop login or your password manager's master password, a passphrase of several random words is easier to enter correctly. Finally, copied text stays on the clipboard, and some phone keyboards keep a clipboard history, so clear it on shared devices.