Password Generator

The formula

• Pool = the characters from every set you tick
• Each position is picked with a cryptographically secure random number
• Combinations = pool size ^ password length
• Entropy = length × log2(pool size), in bits

A worked example

A 16 character password drawn from all four sets gives a pool of 94 characters: 94^16 possible combinations, about 3.7 × 10^31, which is 105 bits of entropy. That’s far beyond any guessing attack that will ever exist.

More about the Password Generator

How strong is 'strong', in real numbers

A 16 character password drawn from all four sets gives a pool of 94 characters: 94^16 possible combinations, about 3.7 × 10^31, or 105 bits of entropy. That’s far beyond any guessing attack that will ever exist, the maths isn’t close.

Length does the heavy lifting. Shrink it to 8 characters and the space collapses to 94^8, still big, but going from 8 to 16 characters doesn’t double your security, it multiplies it beyond recognition. When in doubt, go longer. You’ll never type it anyway.

The rule that matters more than strength

One password per site. Always. The strongest password ever made is worthless once you reuse it, one breached forum hands it to attackers who try it on your email, your bank, everything.

Generate something unique for every account and let a password manager keep track. The manager remembers; you remember one master password. That’s the whole system, and it’s what security professionals actually do.

When the lookalike filter earns its keep

The ‘exclude ambiguous characters’ option drops 0, O, l and 1, the characters humans mix up. Tick it when someone has to read the password aloud, type it from a screen into a TV, or write it on a sticky note.

For passwords you’ll copy paste from a manager, leave it off: a bigger pool is marginally stronger, and you’ll never actually look at the characters.

What this generator is not

It doesn’t make passphrases, there’s no “correct horse battery staple” word mode. Passphrases are memorable and strong, but they’re a different tool. When memorability matters more than compactness (a Wi-Fi password guests type, a master password), reach for a dedicated passphrase generator or your manager’s.

It also doesn’t check passwords against breach lists. A generated password is random, so it’s not in any breach, which is exactly the property you want.

The password manager habit, concretely

Install a manager and generate a 20 character password for your email first, email is the master key, because every “reset password” link lands there. Then work through banking, social media and shopping, replacing each password as you go.

Most managers import from your browser in one click and then offer to save new logins automatically. The first weekend is tedious; after that, making an account means one click on “generate” and you never see the password again.

Two factor is the second lock

A unique password stops credential stuffing; two factor stops nearly everything else. Switch it on for email, banking and cloud storage at minimum, an authenticator app beats SMS codes, which can be intercepted.

Save the backup codes somewhere safe (printed, in a drawer) when you enable 2FA. Lose your phone without them and “secure account” becomes “account you can’t open”, the recovery process is deliberately painful.

Passkeys: the password killer coming for this tool

The industry is moving to passkeys, cryptographic logins tied to your device, with nothing to remember and nothing to phish. Where sites offer them, take them; they’re strictly better than any password this generator can produce.

But passwords aren’t dying tomorrow. Until every site you use supports passkeys, unique generated passwords in a manager are the defense. Think of this tool as the bridge: essential now, gracefully retired later.

What to do when a password leaks

If you get a “your password was in a data breach” alert, move fast: change it everywhere you used it, which should be exactly one site if you kept passwords unique, starting with email and banking.

Check haveibeenpwned.com to see which breaches exposed your addresses, then generate fresh passwords for every affected account. With this generator and a manager, recovery is quick.

The real lesson of a breach isn’t the new password; it’s turning on two factor for the accounts that matter. A leaked password plus 2FA is an inconvenience; a leaked password alone is an open door.

When a site bans symbols, trade length for characters

Some sign up forms reject symbols, cap the length, or silently trim characters they dislike, and that changes what a strong setting looks like. If symbols are banned, do not shrink the password to fit an old habit. Raise the length instead. Suppose you generate 20 characters using lowercase letters only: the pool is 26, so the password carries about 94 bits of entropy, because each character adds roughly 4.7 bits and 20 times 4.7 is 94.

Compare that with 16 characters drawn from the full pool of 94 letters, digits and symbols. Each character adds about 6.55 bits, so 16 times 6.55 gives roughly 105 bits, more security from fewer characters. The practical rule follows from the maths: when the character pool gets smaller, add characters until the total recovers. A 20 character letters only password is a perfectly respectable answer to a restrictive form, while an 8 character one is not, whatever sets it uses.

Getting a generated password safely into storage

The weakest moment in this whole process is the gap between generating a password and saving it. Common mistakes include screenshotting it, sending it to yourself in a message, or leaving it on a clipboard while you browse elsewhere. Instead, generate the password with the sign up form and your password manager both ready, paste it into both places in one sitting, and only then move on to anything else.

Generate several candidates rather than agonising over the first one, but pick by position, say, always take the third, rather than by appearance. Choosing the candidate that looks nicest quietly biases you toward patterns your eyes find friendly, and friendly looking strings are a little less random than the generator intended. Once the chosen password is saved in the manager and works at sign in, clear the clipboard and close the generator tab.

How to use the Password Generator

1. Choose a length, 16 or more characters is the sane choice.
2. Tick the character sets you want: uppercase, lowercase, numbers, symbols.
3. Optionally exclude the ambiguous lookalikes (0, O, l, 1) for easier reading.
4. Click “Generate password”, then copy the result with the copy button.