password generator
Strength as a number, from randomness you can rely on.
The short answer
Strength is length times the log of the pool, and it is a number rather than a colour: 20 characters from a 57-character pool is 117 bits of entropy. Overkill, and no worse for it.
Generated with the browser's cryptographic randomness, not Math.random, and shown with its entropy in bits rather than a green bar that means nothing.
The formula
bits = length × log₂(size of the character pool)
Worked examples
- 8 characters, lower case only
- 37 bits, weak
- 16 characters, mixed case and digits
- 93 bits
- 20 characters, everything on
- 123 bits
Reference table
| Length | a–z | a–z A–Z 0–9 | Everything |
|---|---|---|---|
| 8 characters | 37 | 47 | 49 |
| 12 characters | 56 | 70 | 74 |
| 16 characters | 74 | 93 | 98 |
| 20 characters | 93 | 117 | 123 |
| 24 characters | 111 | 140 | 147 |
How to use it
- 01Set the lengthLength buys more strength than complexity does. Twenty is a sensible default.
- 02Pick the character setsThe entropy figure updates as you change them, so you can see what each one is worth.
- 03Generate and copyNothing is sent anywhere, and nothing is stored between presses.
Also searched for
Searches that land here include password generator, strong password generator, random password, secure password generator and password entropy.
What makes a password hard to guess
Randomness, not cleverness
A password is only as strong as the process that chose it. Human-chosen passwords cluster: substituting 3 for e and adding an exclamation mark is a pattern every cracking tool knows. Machine-chosen ones from a known pool are uniform, which is why their strength can be calculated rather than guessed at.
Where the number comes from
Each character adds the base-two logarithm of the pool size in bits. From a pool of sixty, that is about 5.9 bits a character, so twenty characters is around 118 bits. Below about fifty bits an offline attack on a leaked hash is a matter of hours. Past eighty, the password stops being the weakest thing about the account.
The part this cannot help with
Reuse. A perfect password used in two places is a shared password, and the weaker of the two sites decides its fate. That is what a password manager is for, and generating one strong password per site is the only use of this page that actually helps.
Questions people ask
How long should a password be?
Long enough that guessing is hopeless, which for a mixed-case pool with digits is around sixteen characters and comfortably so at twenty. Length is worth more than exotic symbols: adding four characters to a password beats adding a punctuation set to a short one, every time.
What does the bits figure mean?
How many guesses an attacker needs, expressed as a power of two. Sixty bits means two to the sixtieth attempts to be certain. It is the honest measure, unlike a strength meter, because it does not care whether the password looks complicated — only how many equally likely possibilities it was drawn from.
Why are l, I, 1, O and 0 missing?
Because a password often has to be read off one screen and typed on another device, and those five are the ones people get wrong. Dropping them costs about a tenth of a bit per character, which four extra characters more than repays.