Skip to content
TrueScalers

Password generator

A password generator produces a random string from a chosen character pool. Password strength is measured as entropy in bits, calculated as E = L × log₂(R), where L is the length and R is the pool size. A 20-character password drawn from 94 printable ASCII symbols carries 131 bits of entropy, which is beyond the reach of any brute-force attack.

characters
Calculated in your browser — nothing is uploaded.

Result

Generated password — very strong

KNlfnIH$Av0Q5.Q/9q/y

E = L × log₂(R) = 20 × log₂(86)

Entropy
128.5 bits
Strength rating
Very strong
Character pool size
86
Possible combinations
4.90e+38
Offline crack time at 10¹⁰ guesses/s
7.76e+20 years

A 20-character password drawn from a 86-symbol pool carries 128.5 bits of entropy, which is rated very strong. At ten billion guesses per second, exhausting half that keyspace takes 7.76e+20 years.

Generated in your browser with the Web Crypto CSPRNG. Nothing is transmitted, logged, or stored — reload the page and the password is gone for good.

How to use the password generator

  1. 01

    Choose a length

    Set the length. Sixteen characters is a sound minimum for accounts of value; twenty or more is better where the site permits it.

  2. 02

    Select character sets

    Enable lowercase, uppercase, digits and symbols. Each additional set enlarges the pool and raises entropy per character.

  3. 03

    Exclude look-alikes if needed

    Enable the look-alike filter when the password will be transcribed by hand or read aloud. It removes the digits 0 and 1 and the letters O, o, l and I.

  4. 04

    Copy and store it

    Press copy, then paste directly into a password manager. Reading a password off a screen and retyping it is where transcription errors occur.

  5. 05

    Regenerate if needed

    Press regenerate for a fresh draw. Every generation is independent and no previous value is retained anywhere.

The formula

E = L × log₂(R)
E
Entropy in bits — the base-2 logarithm of the number of equally likely passwords.
L
Password length in characters.
R
The size of the character pool each position is drawn from.
log₂
The base-2 logarithm.

This formula is valid only when every character is chosen independently and uniformly at random, which is what a CSPRNG guarantees and what human-chosen passwords never satisfy. A memorable password of the same length has far less entropy than the formula implies, because its characters are not independent.

Worked example

Length
20 characters
Character sets
Lowercase, uppercase, digits, symbols
Exclude look-alikes
No
Result
128.5 bits of entropy — very strong

The enabled sets contribute 26 lowercase, 26 uppercase, 10 digits and 24 symbols, giving a pool of 86 characters. Entropy is 20 × log₂(86) = 20 × 6.4263 = 128.5 bits. That corresponds to roughly 3.4 × 10³⁸ possible passwords. At ten billion guesses per second, exhausting half that keyspace would take on the order of 5 × 10²⁰ years — many orders of magnitude beyond the age of the universe.

Frequently asked questions

How long should a password be?

Length contributes more to strength than complexity does. Sixteen characters from a mixed pool gives roughly 103 bits of entropy, comfortably beyond offline brute-force reach. NIST Special Publication 800-63B recommends a minimum of 8 characters and support for at least 64, and explicitly advises against forced composition rules and periodic mandatory rotation.

What makes a password strong?

Strength is unpredictability, measured as entropy in bits. A password is strong when it is generated uniformly at random from a large pool and is long enough that the keyspace is infeasible to search. Substitutions such as replacing "a" with "@" add almost nothing, because password-cracking tools apply those transformations automatically.

Is this password generator safe to use?

Generation happens entirely inside your browser using the Web Crypto API's cryptographically secure pseudorandom number generator. No password is sent over the network, written to storage, or logged — this site has no server-side code that could receive one. Closing the tab destroys the value permanently.

Should I use a passphrase instead?

A passphrase of random words is an excellent choice where a password must be memorised. Six words drawn randomly from the 7,776-word Diceware list carry 77.5 bits of entropy — strong, and far easier to remember than a comparable random string. For passwords stored in a manager, memorability is irrelevant and a longer random string is preferable.

How often should passwords be changed?

Only when there is evidence of compromise. NIST SP 800-63B reversed the long-standing rotation advice because forced periodic changes push users toward predictable variations such as appending an incrementing digit. A unique, high-entropy password per account, held in a manager, is materially stronger than a rotated weak one.

What is entropy in bits and what number is enough?

Entropy in bits is the base-2 logarithm of the number of equally likely values a password could have taken. Each additional bit doubles the search space. Below 28 bits is trivially broken, 60 bits resists most online attacks, 80 bits is robust, and anything at or above 128 bits is beyond brute force with any foreseeable technology.

Why does excluding look-alike characters reduce strength?

Removing 0, O, o, 1, l and I shrinks the character pool from 86 to 80, lowering entropy per character from 6.43 to 6.32 bits. Over a 20-character password that costs about 2 bits in total — a negligible trade for eliminating transcription errors when the password must be read aloud or copied by hand.

Sources

Last reviewed: · Formula and sources verified by Syed Aqeel Ahmad Gillani. See the methodology for how every calculation is derived.

Related tools