How long should a password be?

NIST SP 800-63B (revision 4, 2025) requires at least 15 characters for a password used on its own and at least 8 when it is one part of multi-factor sign-in, and says services should accept at least 64. In this generator, 16 characters with all four types is about 103 bits and 20 characters is about 129.

What is password entropy?

A measure, in bits, of how unlikely the most likely password the settings can produce is: one in 2^bits. Each extra bit halves that chance, so 103 bits is about 10^31 equally likely passwords. It applies to a password picked at random, like the ones here, not to one a person made up.

Which symbols does the password generator use?

These 29: the exclamation mark and @ # $ % ^ & * ( ) _ + ~ ` | } { [ ] : ; ? > < , . / - =. They are one fixed set and cannot be picked one by one; the page lists the set in use under Symbols used. With Avoid look-alike characters ticked the | is left out. For a site that refuses some of them, untick Symbols and make the password a little longer.

Do I need symbols in a password?

Not if it is long enough. NIST tells services not to require mixtures of character types. Length adds more: 20 lowercase letters is about 94 bits, while 12 characters of all four types is about 76.

Is the generated password sent or stored anywhere?

No. It is generated in your browser, this tool makes no network request with it, and it is not saved: reload the page and it is gone. It is never part of the page’s HTML either, so each visitor gets a different one.

What does “Avoid look-alike characters” do?

It leaves out O, 0, l, 1, I and |, which are easy to mix up when you read a password aloud or type it from a screen. The set drops from 91 to 85 characters, and a 16-character password from about 103 bits to about 101.

Password Generator

Generate a random password of 8 to 128 characters from uppercase, lowercase, numbers and symbols, and see its entropy in bits. Can skip look-alike characters. How it works

Password Length16

Character set size: 91

Symbols used: !@#$%^&*()_+~`|}{[]:;?><,./-=

16 characters from 91 possible: about 103 bits.

StrengthStrong (about 103 bits)

Bits are the chance of the single most likely password this generator can make, as -log2, rounded down. For one character type that is length × log2(character set size). With several types it is a little lower, because one character of every ticked type is guaranteed. The meter is full at 128 bits. Under 50 bits is weak, 50 to 79 fair, 80 to 119 strong, 120 or more very strong.

The password is generated in your browser with the Web Crypto random generator and is not sent anywhere.

About the Password Generator

A random 16-character password that uses uppercase, lowercase, numbers and symbols has about 103 bits of entropy. With 91 possible characters for each position the plain figure would be 16 × log2(91) = 104 bits, and the rule that every ticked type appears at least once lowers it to 103. This password generator makes one in your browser with the Web Crypto random generator, at any length from 8 to 128.

Password entropy by length and character set

Length	Lowercase only (26)	Upper and lowercase (52)	Letters and numbers (62)	All four types (91)
8	37 bits, Weak	45 bits, Weak	46 bits, Weak	50 bits, Reasonable
12	56 bits, Reasonable	68 bits, Strong	70 bits, Strong	76 bits, Strong
16	75 bits, Strong	91 bits, Strong	94 bits, Strong	103 bits, Strong
20	94 bits, Strong	113 bits, Strong	118 bits, Strong	129 bits, Very Strong
24	112 bits, Strong	136 bits, Very Strong	142 bits, Very Strong	155 bits, Very Strong
32	150 bits, Very Strong	182 bits, Very Strong	190 bits, Very Strong	207 bits, Very Strong

Bits are rounded down. Labels, the same scale as the Password Entropy Calculator: under 28 Very Weak, 28 to 49 Weak, 50 to 59 Reasonable, 60 to 127 Strong, 128 or more Very Strong.

How to use this tool

Set the length with the slider. It starts at 16 and runs from 8 to 128.
Tick the character types to use: uppercase, lowercase, numbers, symbols. Tick “Avoid look-alike characters” to leave out O, 0, l, 1, I and |.
Read the summary line, for example “16 characters from 91 possible: about 103 bits.”
Press Generate New Password for a different one, then copy it.

Frequently asked questions

How long should a password be?: NIST SP 800-63B (revision 4, 2025) requires at least 15 characters for a password used on its own and at least 8 when it is one part of multi-factor sign-in, and says services should accept at least 64. In this generator, 16 characters with all four types is about 103 bits and 20 characters is about 129.
What is password entropy?: A measure, in bits, of how unlikely the most likely password the settings can produce is: one in 2^bits. Each extra bit halves that chance, so 103 bits is about 10^31 equally likely passwords. It applies to a password picked at random, like the ones here, not to one a person made up.
Which symbols does the password generator use?: These 29: the exclamation mark and @ # $ % ^ & * ( ) _ + ~ ` | } { [ ] : ; ? > < , . / - =. They are one fixed set and cannot be picked one by one; the page lists the set in use under Symbols used. With Avoid look-alike characters ticked the | is left out. For a site that refuses some of them, untick Symbols and make the password a little longer.
Do I need symbols in a password?: Not if it is long enough. NIST tells services not to require mixtures of character types. Length adds more: 20 lowercase letters is about 94 bits, while 12 characters of all four types is about 76.
Is the generated password sent or stored anywhere?: No. It is generated in your browser, this tool makes no network request with it, and it is not saved: reload the page and it is gone. It is never part of the page’s HTML either, so each visitor gets a different one.
What does “Avoid look-alike characters” do?: It leaves out O, 0, l, 1, I and |, which are easy to mix up when you read a password aloud or type it from a screen. The set drops from 91 to 85 characters, and a 16-character password from about 103 bits to about 101.

When to use it

Use it when a site asks you to create a password and you have a password manager to keep it in: generate, copy, paste, save. Set the length the site allows. The slider starts at 16 and goes from 8 to 128. Turn on Avoid look-alike characters for a password you will have to read aloud or type from a screen, such as a Wi-Fi key.

The 29 symbols are a fixed set, shown under the options as Symbols used; single symbols cannot be switched off. If a site rejects one of them, untick Symbols and add a character or two of length instead: at 16 characters, upper and lower case with numbers give 94 bits against 103 with symbols.

How the password and the bits are worked out

bits = -log2(chance of the most likely password)

For one character type this is length × log2(number of possible characters). With several types it is a little lower, because one character of every ticked type is guaranteed to appear.

The four character types hold 26 uppercase letters, 26 lowercase letters, 10 digits and 29 symbols, 91 characters in all. Leaving out the look-alikes O, 0, l, 1, I and | brings that to 85.

Example: 16 characters from 91 would be 16 × log2(91) = 104 bits if every position were independent. With the guarantee the figure is 103 bits, shown as Strong. The same length from lowercase letters alone is 75 bits.

Each character is chosen with crypto.getRandomValues and rejection sampling, so no character is more likely than another. One character from every ticked type is placed first, the rest are drawn from all ticked types together, and the whole password is shuffled. The bit figure is rounded down.

The labels are fixed thresholds, the same ones the Password Entropy Calculator uses: under 28 bits Very Weak, 28 to 49 Weak, 50 to 59 Reasonable, 60 to 127 Strong, 128 or more Very Strong. 50 bits is about 16 hours at 10 billion guesses a second. They describe the settings, not how a site stores the password.

Related Tools

View all tools

Dev

Hash Generator

Compute the MD5, SHA-1, SHA-256, SHA-384 or SHA-512 hash of text or a file and compare it with an expected checksum. The file is hashed in your browser.

Dev

HMAC Generator

Compute an HMAC with SHA-1, SHA-256, SHA-384 or SHA-512 and check it against a signature, with webhook presets for GitHub, Stripe, Shopify and Slack.

Dev

AES Encryption

Encrypt and decrypt text with a password using AES-256-GCM, the key derived by PBKDF2-SHA256 at 600,000 iterations. Strength depends on the password.

Dev

PBKDF2 Calculator

Derive a PBKDF2 key in hex or Base64 from a password and salt with HMAC-SHA-1, SHA-256, SHA-384 or SHA-512, and check it against a key you paste.

Dev

Password Entropy Calculator

Estimate password entropy as length × log₂(pool size) and average crack times at three guess rates. Common passwords and patterns are rated Very Weak.

Dev

HTML Sanitizer

Sanitize pasted HTML at Strict, Moderate or Permissive level: scripts, event handlers and javascript: links are removed, and the tool lists what it took out.