Password Generator
Turning this on makes the entropy figure an upper bound rather than the exact number.
The field starts empty on purpose. A password printed into this page when it was built would have been made on a server and given to every reader alike; yours is made in your browser when you press the button.
entropy 104.9 bits
How do you generate a random password?
A random password is drawn from a set of characters with no pattern behind the choice. How hard it is to guess depends on its length and the size of that set.
- Choose how long the password should be. Longer is harder to guess, and the entropy figure below the field moves as you change it.
- Choose which character sets to draw from. Lowercase alone is 26 characters, with uppercase 52, with digits 62, and the full printable ASCII set excluding the space is 94.
- Generate. Each character is drawn from the set you chose using the cryptographic random source in your browser, and no character is more likely than any other.
- Read the entropy beside the result. Entropy in bits = length x log2(size of the character set).
Entropy in bits, by character set and length
Every figure in the table is the length multiplied by the bits one character from that set is worth. Reading down a column shows what another four characters buy you; reading across shows what a larger set buys you.
| Character set | Bits per character | 8 characters | 12 characters | 16 characters | 20 characters |
|---|---|---|---|---|---|
| 26 — lowercase only | 4.70 | 37.6 bits | 56.4 bits | 75.2 bits | 94.0 bits |
| 52 — with uppercase | 5.70 | 45.6 bits | 68.4 bits | 91.2 bits | 114.0 bits |
| 62 — with digits | 5.95 | 47.6 bits | 71.5 bits | 95.3 bits | 119.1 bits |
| 94 — with symbols | 6.55 | 52.4 bits | 78.7 bits | 104.9 bits | 131.1 bits |
Worked Example: sixteen characters
104.9 bits is the answer for the full printable set. A 16-character password carries about 104.9 bits of entropy from the 94 printable ASCII characters, and about 75.2 bits from lowercase letters alone.
16 characters → 104.9 bits, or 75.2 bits from lowercase alone
Those two figures are the same sixteen characters drawn from two different sets, and the gap between them is about thirty bits. Thirty bits is a factor of a billion in how many attempts an exhaustive search needs.
What Makes One Password Harder to Guess Than Another?
Length and the size of the set
Each extra character adds the same number of bits: about 4.7 with lowercase only, about 6.6 with the full printable ASCII set.
How long is long enough
This page publishes no minimum length. Any minimum you have to meet should come from the standard your organisation follows.
What entropy does not measure
Entropy describes how the password was produced, not how it is looked after. A password used on two sites is as weak as the weaker site, and one typed into a convincing copy of a login page has been handed over whatever its entropy was.
Frequently Asked Questions
What is password entropy, and what do the bits mean?
Entropy counts how many equally likely passwords the settings could have produced, written as a power of two. Each extra bit doubles that number, so 60 bits is twice as many candidates as 59.
How much does adding a character or a character set change the strength?
One more character always adds the same amount, so the total climbs in a straight line with length. Widening the set raises what every character is worth at once, which is why it moves the figure further than one extra character does.
Is the password sent anywhere?
The password is produced by JavaScript running in your browser and is never transmitted, stored or logged. The page has to be built that way for the claim to hold: the browser's cryptographic random source, no network call, and no analytics event carrying the value.
The rest of the site is on the tool index, grouped by family.