Password Generator
Generate strong random passwords with custom length and character sets. Built-in entropy strength meter and copy-to-clipboard. Everything runs in your browser.
Your password
130 bits — ExcellentCharacter sets
5 alternates
Same settings, freshly generated
- Enable at least one character set to generate.
What makes a password strong?
Strength is not about clever substitutions like turning “password” into “p@ssw0rd” — attackers know every common trick. What actually matters is entropy: the number of random binary choices baked into the secret. More entropy means a brute-force attacker has exponentially more candidates to try.
Entropy is approximated by bits = length × log2(charset size). Doubling the length doubles the bits; adding character classes only grows it logarithmically. In practice, length is the single cheapest lever — go long before you go exotic.
8 chars
52
bits of entropy
12 chars
79
bits of entropy
16 chars
105
bits of entropy
20 chars
131
bits of entropy
Assumes the full 94-character printable ASCII set (letters, digits, symbols).
Length vs character set
Entropy bits at each length and charset combination. Cells at or above 100 bits are bold — that is the rough threshold considered safe against any plausible offline attacker for the foreseeable future.
| Length | lower only(26 chars) | + upper(52 chars) | + digits(62 chars) | + symbols(94 chars) |
|---|---|---|---|---|
| 8 | 38 | 46 | 48 | 52 |
| 12 | 56 | 68 | 71 | 79 |
| 16 | 75 | 91 | 95 | 105 |
| 20 | 94 | 114 | 119 | 131 |
| 24 | 113 | 137 | 143 | 157 |
Best practices
- Use a password manager: You cannot memorize unique high-entropy strings for hundreds of accounts. A manager generates, stores, and autofills them so you only remember one master phrase.
- Never reuse passwords: One breach on a forgotten forum becomes a breach of your email, bank, and cloud storage if the same secret protects all of them.
- Enable 2FA wherever offered: A second factor (TOTP app, hardware key, or passkey) blocks an attacker even when the password leaks.
- Avoid personal info and dictionary words: Pet names, birthdays, and song lyrics are the first thing targeted-attack tools try.
- Rotate after any breach disclosure: Subscribe to a breach notifier and replace any password that appears in a public dump, even partially.
- Length beats clever substitutions: Twenty random characters is dramatically stronger than ten characters with a sprinkling of @ and $. Spend your budget on length first.
Privacy first
Generation happens entirely in your browser using crypto.getRandomValues(). No password is sent to a server, logged, or stored by Toolsflare. Close the tab and it’s gone.