Password Generator - Free Online Random Password Generator

Password Generator Guide

A password generator replaces human habits with randomness. Asked to pick something random, people reliably produce patterns — a capital first letter, a digit at the end, a familiar word in the middle — while a generator draws each character independently from a fixed pool. The practical measure of strength is not how complicated a password looks, but how many equally likely candidates an attacker would have to test. That quantity is called entropy, and it follows from just two inputs: length and pool size.

Character Sets and Pool Size

Every character type you tick enlarges the pool the generator draws from. The figures below use the pools available in this tool.

Character pools and per-character entropy

Selection	Pool size	Entropy per character	12-character total
Digits only	10	3.3219 bits	39.86 bits
Lowercase only	26	4.7004 bits	56.41 bits
Lowercase + digits	36	5.1699 bits	62.04 bits
Upper + lower + digits (default)	62	5.9542 bits	71.45 bits
All four types including symbols	95	6.5699 bits	78.84 bits

Length Beats Complexity

Entropy grows linearly with length but only logarithmically with pool size. At 12 characters, widening the pool from 62 to 95 adds 7.39 bits; simply moving from 12 to 16 characters adds 23.82 bits.

Length versus guess space (pool of 62)

Length	Entropy	Possible combinations
4	23.82 bits	1.48e+07
6	35.73 bits	5.68e+10
8	47.63 bits	2.18e+14
10	59.54 bits	8.39e+17
12 (default)	71.45 bits	3.23e+21
16	95.27 bits	4.77e+28
20	119.08 bits	7.04e+35
24	142.90 bits	1.04e+43

Worked Examples

All three use the tool defaults — length 12, uppercase plus lowercase plus digits, one password — so you can reproduce the figures without changing any setting.

1. Default: 12 characters from a 62-symbol pool gives 12 × 5.9542 = 71.45 bits, or roughly 3.23e+21 equally likely candidates.
2. Adding symbols: ticking Symbols raises the pool to 95 and the result to 78.84 bits — 7.39 bits more at the same length.
3. Lengthening instead: keeping the default pool but moving to 16 characters gives 95.27 bits, about 23.82 bits more. Length is the cheaper lever.

How Long Would Guessing Take?

The figures below assume an attacker testing 10 billion (1e10) guesses per second against a password known to be uniformly random. Real attacks are slower against rate-limited services and far faster against breached databases, so read these as relative comparisons rather than guarantees.

Time to exhaust the search space at 1e10 guesses per second

Password	Entropy	Time to exhaust
12 chars, lowercase only	56.41 bits	110.8 days
12 chars, lowercase + digits	62.04 bits	15 years
12 chars, default three types	71.45 bits	1.02e+04 years
12 chars, all four types	78.84 bits	1.71e+06 years
16 chars, default three types	95.27 bits	1.51e+11 years

Note: these numbers describe pure guessing. Most real account takeovers come from reused credentials, phishing, or previously breached databases — not from brute force.

What Actually Weakens a Password

Common weaknesses and why they fail

Pattern	Why it fails	Better approach
Dictionary word plus digits, such as a season and a year	Cracking tools try word lists with common suffixes first	Generate random strings; prefer length over decoration
Letter-to-symbol substitution, such as swapping a for 4	Substitution rules are built into cracking tools	Randomness, not character swapping
Reusing one password across sites	A single breach compromises every account using it	One generated password per site, kept in a manager
Personal data such as names or birthdays	Guessable from public profiles	No personal references at all
Short passwords with forced symbols	Entropy is dominated by length	Go longer before adding character types

Current guidance, including NIST SP 800-63B, has moved away from forced character-composition rules and scheduled rotation, toward longer randomly generated secrets, screening against known breached values, and rate limiting at the verifier.

Frequently Asked Questions

Why does length matter more than symbols? Entropy equals length × log2(pool size). Adding a character type widens the pool a little, while each extra character adds the full per-character entropy, so length compounds faster.

Is a 12-character generated password enough? With the default three character types it yields 71.45 bits, far beyond exhaustive search for any rate-limited service. Increase length rather than adding symbols when you want more margin.

Should I change passwords every few months? Scheduled rotation is no longer recommended by current guidance. Rotate when there is evidence of compromise, and keep every password unique instead.

Where are the generated passwords stored? Nowhere. Generation happens inside your browser and nothing is transmitted, so copy and save what you need before leaving the page.

Why do some sites reject symbols? Legacy systems sometimes restrict allowed characters. Untick Symbols to generate from the 62-character pool, which nearly all systems accept.

Related Reading

For the reasoning behind random generation and breach screening, see our password security guide. The Random Number Generator covers uniform draws and custom ranges, and the QR Code Generator turns a secret into a scannable code when you need to share one.