CalcKit
Password Generator
Generate strong random passwords online: pick the length, letters, numbers and symbols, avoid look-alike characters and see how strong each is. In your browser.
Your Password
Options
Password Generator: A Quick Guide
Make strong, random passwords of any length from 4 to 128 characters, with the kinds of characters a site asks for. Each password comes from your browser's cryptographic random generator, is made on your device, and is never sent anywhere or stored.
How to use the Password Generator
- Set the length with the slider or by typing it in. A password of 16 characters is ready when the page opens.
- Choose the characters: uppercase and lowercase letters, numbers and symbols. A new password appears with every change.
- Edit the symbols if a site only accepts some of them: delete the ones it refuses from Symbols to use.
- Press Generate for another password, or set How many to get a list, one per line.
- Copy the password and paste it into the site and into your password manager.
The options
- Length: the number of characters in each password. Length does more for strength than anything else.
- Characters: the kinds of characters to use. With all four, a password draws on 90 characters: 26 uppercase letters, 26 lowercase letters, 10 digits and 28 symbols.
- Symbols to use: the ASCII punctuation the password may contain. The list starts with every symbol on a keyboard except
",',`and\, which often break when a password is pasted into code, a command line or a settings file. Spaces are ignored, and only ASCII punctuation is accepted. - Avoid look-alikes: leaves out
0 O o 1 l I |, which are hard to tell apart in some fonts. Use it for a password you have to read out or type by hand. - At least one of each kind: makes sure every kind you chose appears, as many sites require. A password that misses one is thrown away and drawn again, so no character is forced into a fixed place.
- How many: from 1 to 100 passwords at once, one per line.
How strong is the password?
The strength under the password is its entropy in bits: how many possible passwords the options allow, written as a power of 2. A password of 16 characters, each chosen from 90, is one of 90^16 passwords, about 2^103.9, so it has 103.9 bits. Every extra bit doubles the number of guesses an attacker needs. The figure shown is exact for your options, including the rule of at least one of each kind.
| Length | Lowercase (26) | Letters and numbers (62) | All four kinds (90) |
|---|---|---|---|
| 8 | 37.6 bits | 47.6 bits | 51.9 bits |
| 12 | 56.4 bits | 71.5 bits | 77.9 bits |
| 16 | 75.2 bits | 95.3 bits | 103.9 bits |
| 20 | 94.0 bits | 119.1 bits | 129.8 bits |
The labels assume the worst case, an attacker who has stolen a site's password file and tests a trillion guesses a second:
- Weak: under 50 bits. Every such password can be tried within about 20 minutes.
- Fair: 50 to 69 bits. Safe against guessing on a login page, but not against that attack for long.
- Strong: 70 to 99 bits. Trying them all would take from about 37 years at 70 bits to about 20 billion years at 99.
- Very strong: 100 bits or more, beyond any foreseeable attack.
How random is it?
The characters come from crypto.getRandomValues, the generator browsers use for encryption keys, not from the predictable Math.random. Each one is picked with rejection sampling: a random number that falls in the uneven leftover range is drawn again, so every character of the set is exactly as likely. A simple remainder would make some characters slightly more common. Every password that matches your options is equally likely, and nobody, this site included, can predict or repeat one.
Frequently asked questions
Is it safe to use an online password generator?
This one makes the password in your browser, with your device's own random generator, and never sends or saves it: the page works the same with your internet connection off. A password is only as safe as where you keep it, so store it in a password manager rather than a note or a chat.
How long should a password be?
At least 12 characters, and 16 or more for important accounts such as your email, which can reset all the others. Current guidance favours length over complicated rules: the US National Institute of Standards and Technology (NIST) asks for at least 15 characters when a password is the only thing protecting an account.
Why does a site refuse the password?
Some sites accept only certain symbols, or limit the length. Delete the symbols the site doesn't allow from Symbols to use, or turn Symbols off and make the password a few characters longer to keep its strength.
Should I use a different password for every site?
Yes. When one site leaks its passwords, attackers try them on others. A unique password for each account, kept in a password manager, stops one leak from opening the rest.