Password Generator
Generate a strong password, and see how strong it actually is.
Password Generator
Your password
6@!vk9(!S.u.Y{Tm
- Strength (bits of entropy)101.15
- StrengthStrong
- Characters it chooses from80
- Time to guess by brute forceAbout 10^11 years
Works out in your browser. Nothing you type is sent anywhere.
In short: Password Generator
A password of 16 characters drawn from a pool of 80 carries 101.15 bits of entropy, which rates as Strong. Guessing it by brute force at a hundred billion attempts a second would take About 10^11 years. Length raises that far faster than adding exotic characters does.
What is Password?
Password strength is measured in bits of entropy, which is how many guesses an attacker would need, and it depends on the length and the set of characters used.
How is Password calculated?
Multiply the length by the base-two logarithm of the pool size, which gives the bits of entropy. Each extra character multiplies the work for an attacker, which is why a longer password from a smaller pool usually beats a short one from a larger pool.
- bitsthe bits of entropy, a measure of guessing difficulty
- Lthe length of the password
- Pthe number of characters it can draw from
A worked example
| Length | 16 |
|---|---|
| Small letters (a-z) | Yes |
| Capital letters (A-Z) | Yes |
| Numbers (0-9) | Yes |
| Symbols | Yes |
| Leave out look-alike characters | Yes |
| How many | 1 |
| Result | |
| Your password | tQ2*d)CC{@P8k{#, |
| Strength (bits of entropy) | 101.15 |
| Strength | Strong |
| Characters it chooses from | 80 |
| Time to guess by brute force | About 10^11 years |
Every figure in this table is produced by the same calculation the tool above runs.
How to use this password generator
- Set the length. Longer helps more than anything else.
- Choose which character sets to draw from.
- Leave out the look-alike characters if you will have to read it aloud.
- Copy it straight into your password manager.
Questions people ask
How long should a password be?
Long enough that the entropy figure here is comfortably high, which in practice means well beyond the minimum most sites ask for. Length contributes more than character variety: adding characters multiplies the work, while adding symbols only widens the pool. Sixteen or more is a reasonable floor for anything that matters.
Is the guessing time realistic?
It assumes an attacker who has the hashed password and can try a hundred billion guesses a second, which is the right assumption for a leaked database. An attacker typing at a login form is far slower. It says nothing about a password that was simply stolen rather than guessed.
Why leave out look-alike characters?
Because the capital letter O and the digit zero, and the lowercase l and the digit one, are easy to confuse when a password has to be read aloud or typed from paper. Dropping them costs a little entropy and saves a lot of frustration. Leave them in if the password only ever lives in a manager.
Is the password generated on a server?
No. It is generated in your browser by its own cryptographic random source, so it never travels anywhere. This tool also refuses to put it into a shareable link or an image, which is why those buttons are missing here.
Accuracy and sources
Checked by the Daytoolz team on 16 October 2026. How we check our tools.