Random Password Generator With Entropy by Length

Set an exact length from 6 to 64 characters, choose the character types, and get up to 20 passwords with the entropy for those settings shown in bits.

Runs in your browserFree, no sign-upLast reviewed October 8, 2026

Fill in the settings to see your result here.

Your result appears here instantly — nothing is uploaded.

Quick answers

How long should a password be?: At least 12 random characters, and 15 or more where the password is the only thing protecting the account, which is the minimum current NIST guidance asks services to require. A random 16-character password using all character types has about 103 bits of entropy, far beyond guessing.
How strong is an 18-character password?: A random 18-character password drawn from all 87 characters this tool uses has 116 bits of entropy. Letters and numbers only gives 107.2 bits. Both are rated Very strong here, and both are well past the point where length is the weak link.
How strong is a 30-character password?: 193.3 bits with uppercase, lowercase, numbers and symbols, or 178.6 bits with letters and numbers only. That is more than a 128-bit encryption key, so going longer adds nothing practical. Use 30 characters when a system asks for a long key, not because 20 is unsafe.
What is a dummy password?: A dummy password is a made-up password used as a placeholder in test accounts, demos, screenshots, documentation and seed data, where no real account is at risk. It should still look realistic so that length and character rules in the software being tested are exercised properly.
Is a longer password better than one with symbols?: Yes. Adding symbols to letters and numbers raises each character from about 5.95 to 6.44 bits. Adding one more character adds about 6 bits outright. A 12-character password with symbols has 77.3 bits; 14 characters without symbols has 83.4.
Which characters does exclude ambiguous remove?: Twelve characters that are easy to misread: capital I, lowercase l, digit 1, capital O, lowercase o, digit 0, capital B, digit 8, capital S, digit 5, capital Z and digit 2. With all four types ticked the pool drops from 87 to 75 characters.

About Password Generator

This random password generator makes 1 to 20 passwords at a time, each exactly the length you set between 6 and 64 characters, from any mix of uppercase, lowercase, numbers and 25 symbols. Every password contains at least one character from each type you tick. With all four types on, the pool is 87 characters and each character adds about 6.44 bits, so the default 16 characters comes to 103.1 bits, an 18-character password to 116 bits and a 30-character one to 193.3 bits. One caveat matters: the randomness comes from a seeded generator, not the browser's cryptographic source, so treat the output as right for test data, dummy passwords and low-risk logins and use your password manager for accounts that matter.

Password entropy by length

Figures and ratings are the ones the Strength panel shows for each length. The tool rates under 40 bits Weak, 40 to under 60 Fair, 60 to under 90 Strong and 90 or more Very strong.

Length	All four types (87 characters)	Rating	Letters and numbers (62 characters)	Rating
6	38.7 bits	Weak	35.7 bits	Weak
8	51.5 bits	Fair	47.6 bits	Fair
10	64.4 bits	Strong	59.5 bits	Fair
12	77.3 bits	Strong	71.5 bits	Strong
14	90.2 bits	Very strong	83.4 bits	Strong
16	103.1 bits	Very strong	95.3 bits	Very strong
18	116 bits	Very strong	107.2 bits	Very strong
20	128.9 bits	Very strong	119.1 bits	Very strong
24	154.6 bits	Very strong	142.9 bits	Very strong
30	193.3 bits	Very strong	178.6 bits	Very strong
32	206.2 bits	Very strong	190.5 bits	Very strong
64	412.3 bits	Very strong	381.1 bits	Very strong

These figures describe an ideally random password of that length. See the section on the random source below for how this tool differs.

Character pool for each combination of settings

Entropy is shown for a 16-character password.

Types ticked	Pool size	Bits per character	Entropy at 16 characters
Uppercase, lowercase, numbers, symbols	87	6.44	103.1 bits
All four, ambiguous excluded	75	6.23	99.7 bits
Uppercase, lowercase, numbers	62	5.95	95.3 bits
Uppercase and lowercase	52	5.70	91.2 bits
Uppercase, lowercase, numbers, ambiguous excluded	50	5.64	90.3 bits
Lowercase and numbers	36	5.17	82.7 bits
Lowercase only	26	4.70	75.2 bits
Symbols only	25	4.64	74.3 bits
Numbers only	10	3.32	53.2 bits

The 25 symbols are ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > and ?. Space, quotes, slashes, the pipe, tilde and backtick are never used. Characters such as $, &, ; and ! still need quoting if you paste a password into a shell command.

The entropy formula the Strength panel uses

entropy in bits = length x log2(pool size)

The pool size is the number of different characters available after your ticks and the ambiguous filter are applied. For 16 characters from 87, log2(87) is about 6.44, and 16 x 6.44 = 103.1 bits. The Combinations figure is the same number written as a power of two, 2^103. Each extra bit doubles the number of passwords an attacker would have to try.

Sample passwords at common lengths

Real output from the tool, shown so you can see the shape of each setting. Do not use these exact strings: they are published on this page. Your own results differ on every press of Generate.

18 characters, all four types

Length 18, all four types ticked

as)4%]VGh,Ze?p,o2<

Entropy 116 bits, pool 87, rated Very strong.

30 characters, all four types

Length 30, all four types ticked

,%G42^&+s]4noI^c4p<,$RVZe)Gah?

Entropy 193.3 bits, rated Very strong.

20 characters, no symbols

Length 20, Symbols unticked

y8P9cdEVZ1Sz4fhv6vm3

Entropy 119.1 bits, pool 62. Useful where a site rejects punctuation.

12 characters, easy to read

Length 12, Symbols unticked, Exclude ambiguous characters ticked

YhtwVe9v6E6b

Entropy 67.7 bits, pool 50, rated Strong. No I, l, 1, O, o, 0, B, 8, S, 5, Z or 2 can appear.

8 digits only

Length 8, only Numbers ticked

93085437

Entropy 26.6 bits, rated Weak. The panel warns that this is below the roughly 60 bits recommended for an account.

The random source, and what these passwords are suitable for

The entropy figure assumes every character is chosen by a perfect random source. This random password generator does not use one. Each press of Generate picks a starting seed between 0 and 999,999 using the browser's ordinary random function, and a small fast generator called mulberry32 turns that seed into characters. For any given combination of settings there are therefore at most a million possible batches, which is about 20 bits, whatever the panel says. An attacker who knew a password was made here, and guessed the settings, could regenerate every candidate quickly.

That makes the output a good fit for dummy passwords: seed data for a staging database, test users, form validation checks, screenshots and documentation, or temporary credentials that are changed at first login. It is also reasonable for throwaway sign-ups you do not care about.

For email, banking, work accounts, a password manager master password or anything used as an encryption key, use the generator in your password manager or operating system. Those draw on the system's cryptographic random source, which cannot be replayed from a seed. Nothing you generate on this page is sent to a server, but that is a separate question from how the randomness is produced.

What the generator guarantees and what it does not

Exact length: every password is exactly the Length you set.
One of each: every password contains at least one character from each type you ticked.
No pattern rules: characters can repeat, and there is no option to forbid consecutive or duplicate characters.
No custom symbol set: you cannot add or remove individual symbols, only turn the whole group on or off.
No pronounceable or word-based mode: for words, use a passphrase tool instead.
No breach check: the tool does not test a password against lists of leaked passwords.
Limits: the Length slider runs from 6 to 64 characters, and asking for more than 20 passwords in one batch gives an error.

How to get your result

1
Drag Length to the number of characters you need, from 6 to 64.
2
Enter How many passwords to list, from 1 to 20.
3
Tick the types to include: Uppercase (A–Z), Lowercase (a–z), Numbers (0–9) and Symbols (!@#$…).
4
Tick Exclude ambiguous characters if the password will be read from paper or said aloud.
5
Press Generate for a new batch, check Entropy and Character pool in the Strength panel, then copy a password or download passwords.txt.

Common questions

Are the passwords sent to or stored on a server?

No. They are generated by JavaScript in your browser and never transmitted. Copying one puts it on your clipboard, and downloading saves a plain text file to your device, so clear both if you are on a shared computer.

Why is my password missing symbols a site requires?

Check that Symbols is ticked. When it is, each password contains at least one of the 25 symbols listed above. If a site accepts only certain symbols and rejects the one you got, press Generate for another batch and pick a password whose symbols are on the site's allowed list.

What does the Combinations figure mean?

It is the number of different passwords possible with your length and character pool, written as a power of two. 2^103 means about ten thousand billion billion billion. It is the entropy figure rounded to a whole number of bits.

Should I exclude ambiguous characters?

Only when a person has to read or type the password: a Wi-Fi key on a card, a code read over the phone, a login on a TV. For anything pasted from a password manager, leave the box unticked. If you tick it, add a character to the length to make up the lost entropy.

Why does changing the length keep some of the same characters?

Changing a setting without pressing Generate rebuilds the list from the same seed, so a longer password is made from many of the same random draws and looks related to the previous one. Press Generate to start from a new seed.

Can I generate passwords for a whole team at once?

You can make 20 per batch and download them as passwords.txt, one per line, then press Generate for the next 20. Because of the random source described above, treat these as temporary passwords that each person must change when they first sign in.

Do I need to change a strong password regularly?

Not on a schedule. Current NIST guidance says services should not force periodic changes and should require a change only when there is evidence the password has been compromised. Use a different password for every account so that one leak does not expose the others.

What is a good password length for Wi-Fi?

WPA2 and WPA3 personal passphrases can be 8 to 63 characters. Sixteen or more random characters is a sensible choice. Tick Exclude ambiguous characters and consider leaving Symbols off, since guests will be typing it on phone keyboards.