What is the Password Generator?
The Password Generator creates a random password from a character pool you choose — lowercase, uppercase, numbers and symbols — at a length you set, generated using your browser's cryptographically secure random number source rather than a predictable pattern. A strong password is not about looking complicated to a human; it is about how many possible passwords an attacker would need to try before hitting yours. This tool maximises that number directly: every character is chosen independently at random from your selected pool, with no dictionary words, no predictable substitutions, and no pattern to guess.
Length matters more than complexity rules once you are generating randomly rather than typing by hand. A 20-character password using only lowercase letters is harder to brute-force than an 8-character password using every character type — because the total number of possible passwords depends on both pool size and length, and length grows the total far faster.
Why use a free password generator?
Cryptographically random, not pattern-based
Characters are generated using your browser's secure random number API, not a simple pseudo-random function that could produce predictable sequences.
Full control over the character pool
Choose any combination of lowercase, uppercase, numbers and symbols. Some legacy systems restrict which symbols are allowed — you can match that restriction directly.
Length up to what you need
Generate anything from a short PIN-style code to a long passphrase-equivalent string, depending on what the account you are securing supports.
Nothing is transmitted or logged
Generation happens entirely in your browser. The password is never sent to a server, so there is no record of it anywhere but your own screen and clipboard.
How do you use the Password Generator?
- 1
Set the length
Choose how many characters you need. Longer is stronger — aim for at least 16 characters where the account allows it.
- 2
Choose which character types to include
Toggle lowercase, uppercase, numbers and symbols. Include all four unless the account you are setting a password for restricts them.
- 3
Generate the password
A new random password is created immediately from your chosen length and character pool.
- 4
Copy it and store it properly
Copy the password into a password manager rather than a plain text file or note — that is how you avoid needing to remember it.
How is password generator calculated?
Entropy (bits) = Length × log₂(Pool size)Where:
- Length
- Number of characters in the password
- Pool size
- How many distinct characters could appear at each position — 26 for lowercase only, up to roughly 94 with lowercase, uppercase, numbers and common symbols combined
- Entropy (bits)
- A measure of how many guesses, in powers of two, an attacker would need in the worst case to try every possible password of that length and pool
The simple version
Every extra character you add multiplies the number of possible passwords, and every character type you include multiplies it further. A 12-character password using all four character types has vastly more possible combinations than an 8-character one using the same four types — length has more effect on strength than adding more character types to a short password.
What does it look like in practice?
12 characters, all four character types
Input
Length 12, pool size 94 (lowercase + uppercase + numbers + symbols)
Result
Entropy ≈ 78.7 bits
12 × log₂(94) = 12 × 6.55 ≈ 78.7 bits. This is generally considered strong for most personal account use.
8 characters, all four character types
Input
Length 8, pool size 94
Result
Entropy ≈ 52.4 bits
8 × 6.55 ≈ 52.4 bits — noticeably weaker than the 12-character example despite using the same character pool, because length has a larger effect than pool size on total entropy.
16 characters, lowercase only
Input
Length 16, pool size 26 (lowercase letters only)
Result
Entropy ≈ 75.2 bits
16 × log₂(26) = 16 × 4.70 ≈ 75.2 bits — close to the strength of the shorter 12-character example that used all four character types, illustrating that a longer password with a smaller pool can rival a shorter one with a larger pool.
How accurate is it?
The entropy figure is calculated exactly from length and pool size using standard information theory. What it cannot tell you is how long a real attacker would actually take to guess your password, because that depends entirely on factors outside this calculation.
- How fast an attacker can try guesses depends on how the service storing your password protects it — a slow, properly-salted hashing algorithm like bcrypt or Argon2 can limit an attacker to a few thousand guesses per second, while a poorly protected or unsalted system can allow billions per second on modern hardware. This is invisible to you as a user and entirely the service's responsibility.
- Entropy assumes every character was chosen independently at random. A password you construct by hand, even one that looks complex, is not random in this sense — human-chosen "random" passwords are measurably more predictable than machine-generated ones.
- A strong, unique password does not protect you from a breach on the service's end, phishing, or reusing the same password elsewhere. Length and randomness only address one part of account security.
What should you know before using it?
Character pool sizes and the entropy each contributes per character:
| Character set | Pool size and bits per character |
|---|---|
| Lowercase only (a–z) | 26 characters — 4.70 bits per character |
| Lowercase + uppercase (a–z, A–Z) | 52 characters — 5.70 bits per character |
| Lowercase + uppercase + numbers | 62 characters — 5.95 bits per character |
| All four types (+ common symbols) | ~94 characters — 6.55 bits per character |
Which tools relate to the password generator?
The password generator is one of 16 generators on this site. These are the ones most often used alongside it — either because they handle the next step in the same job, or because they answer a question this tool raises.
Password Strength Checker
Test an existing password — including one you already use — for weaknesses, rather than generating a new one from scratch.
MD5 Generator
See how a hashing function turns text into a fixed-length digest — related to, but distinct from, how a service should actually store your password (never plain MD5).
When should you use a password generator?
Because the password generator runs entirely in your browser, it suits work you would not want to hand to a third-party server — client files, unpublished drafts, anything under an NDA. These are the situations people reach for it in most often.
New account signup
Generate a unique password for every new account rather than reusing one across services — a breach on one site then cannot expose the others.
Replacing a weak or reused password
Swap out an old, memorable-but-weak password for a properly random one, storing it in a password manager instead of memorising it.
Wi-Fi and device passphrases
Generate a long random string for a router or device passphrase, where you only need to enter it once per device rather than recall it daily.
API keys and shared secrets
Developers use a random generator with a custom character pool to create test credentials or shared secrets that avoid predictable patterns.
Frequently asked questions
What makes a password strong?
How long should a strong password be?
Is a random password safer than a memorable passphrase?
Should I include symbols in my password?
Can this password be cracked?
Is my generated password sent to your server?
How is a random password different from one I make up myself?
Is the password generator safe to use?
This tool runs entirely inside your browser. Your text, files and settings are processed on your own device and are never uploaded to our servers — there is nothing for us to store, log or leak. You can confirm it yourself: open your browser DevTools, switch to the Network tab, and use the tool. You will not see an upload request. It also means the tool keeps working if your connection drops mid-task.
Where do these figures come from?
Every method, threshold and standard this page relies on, with a link to the document that defines it. Check them — a tool that will not show its sources is asking you to take its word for it.
- 1Digital Identity Guidelines: Authentication and Lifecycle Management
National Institute of Standards and Technology (NIST), Special Publication 800-63B
Supports: The guidance that password length matters more than complexity rules, and the general framing of password strength as resistance to guessing.
- 2A Mathematical Theory of Communication
Shannon CE — Bell System Technical Journal · 1948
Supports: The entropy formula (bits = length × log₂(pool size)) used to calculate password strength.
Read more about password generator
What is a Password Manager and Why Should You Use One Today?
Wondering what is a password manager? Learn how it secures your logins, beats reuse and notebooks, and how to pick the right one today. No signup required.
2 min read
How Tax Preparers Use Free PDF Tools to Survive Filing Season Faster
Discover how tax preparers use free PDF tools to compress, merge, and secure client returns for faster, safer filing during peak season. No signup required.
3 min read
Password Managers for Beginners: A Stress-Free Guide to Safer Logins
Password managers for beginners explained simply. Pick the right one, set it up, and start saving safer logins with free tools today. No signup required, ever.
2 min read
More on the Smart SEO Toolz blog.
Need something this tool can’t do?
If you need a feature added, spotted something wrong, or want a custom tool or website built for your business, tell us. We read every message and we build what people actually ask for.
More tools
Tools that pair well with this one
Browse every category
- SEO Tools31
- Keyword Tools7
- Domain & IP Tools18
- Text Tools20
- Writing Tools12
- Image Tools31
- PDF Tools17
- Unit Converters14
- Calculators21
- Developer Tools13
- Generators16
- Design & CSS Tools6
- Games8
Looking for something else? See all 214 tools, browse the full site index or read the guides on our blog.