Secure password generator
The password is drawn at random by your device, with the browser's cryptographic generator: it is never sent or stored. For a password used on its own, NIST asks for at least 15 characters.
- Checked on thousands of cases
- Sources: NIST SP 800-63B-4
- Updated November 6, 2026
Your password
Entropy · about 10^31 possibilities
At least 15 characters: the NIST minimum for a password used on its own.
Created in your browser: never sent, never stored.
Quick challenge
Streak 0Best 0
Test yourself: every answer is computed by the tool, and the wrong choices are the most common traps.
How it works
Formula: Entropy (bits) = length × log₂(number of characters)
Each character is drawn uniformly at random from the chosen sets: lowercase (26), uppercase (26), digits (10) and symbols (32). Entropy measures how hard the password is to guess: length × log₂(number of possible characters). 16 characters out of 94 give about 105 bits, more than 10^31 possibilities. Length matters more than variety: every extra character multiplies the possibilities. NIST (SP 800-63B-4) asks for at least 15 characters for a password used on its own, or 8 when it is one of several factors, and does not require mixing character types. When a set is ticked, the generator makes sure it appears at least once, which removes a tiny share of the possibilities.
Entropy by length and character set
| Length | Digits (10) | Lowercase (26) | Letters (52) | Letters and digits (62) | All (94) |
|---|---|---|---|---|---|
| 8 | 27 bits | 38 bits | 46 bits | 48 bits | 52 bits |
| 12 | 40 bits | 56 bits | 68 bits | 71 bits | 79 bits |
| 15 | 50 bits | 71 bits | 86 bits | 89 bits | 98 bits |
| 16 | 53 bits | 75 bits | 91 bits | 95 bits | 105 bits |
| 20 | 66 bits | 94 bits | 114 bits | 119 bits | 131 bits |
| 32 | 106 bits | 150 bits | 182 bits | 191 bits | 210 bits |
Frequently asked questions
How long should a password be?
NIST recommends at least 15 characters for a password used on its own. A password manager lets you use long ones, different for every site, without having to remember them.
Is this generator safe?
The password is created in your browser with crypto.getRandomValues, the random generator meant for cryptography. It is never sent over the internet, never put in the page address and never stored.
What is password entropy?
It is the number of bits of uncertainty: each extra bit doubles the number of possible passwords. A 4-digit PIN has only 10,000 possibilities, about 13 bits.