Customize length and character types, then generate a strong random password.
A strong password combines length with a variety of character types. Each added character type multiplies the number of possible combinations, making brute-force guessing harder. This tool uses your browser's built-in random number generator to create passwords that never leave your device.
To generate a strong password, pick a character pool (uppercase, lowercase, numbers, symbols), then use a cryptographically secure random number generator to pick one character from that pool per position, repeated for the chosen length. Example: with all four character types and length 16, this tool's pool is 88 characters, giving 88^16 (about 1.3 x 10^31) possible passwords.
| Length | Character types | Pool size | Possible passwords |
|---|---|---|---|
| 8 | Lowercase only | 26 | 2.1 x 10^11 |
| 8 | All 4 types | 88 | 3.6 x 10^15 |
| 12 | All 4 types | 88 | 2.2 x 10^23 |
| 16 | All 4 types | 88 | 1.3 x 10^31 |
| 20 | All 4 types | 88 | 7.8 x 10^38 |
Length matters more. NIST SP 800-63B specifically recommends prioritizing length over forced complexity rules, because each additional character multiplies the search space more than adding one more character type does — a longer password built from a passphrase of ordinary words can be stronger than a short one stuffed with symbols.
No. The password is generated and displayed entirely inside your browser using JavaScript's crypto.getRandomValues() — nothing is transmitted to a server, logged, or stored, so the password never leaves your device unless you copy and paste it elsewhere yourself.
Strength scales exponentially with pool size, not linearly. Adding this tool's 26 symbols to a 62-character alphanumeric pool (26 uppercase + 26 lowercase + 10 digits) brings it to 88 characters, and because the exponent (length) stays the same, that larger base multiplies the total number of possible passwords many times over.
No. A password's strength only protects against guessing attacks; it does nothing to prevent damage if one site's database is breached and the same password is reused elsewhere. Use a unique password per site, ideally managed with a password manager.
This tool generates passwords entirely client-side using the Web Crypto API and estimates strength only from length and character-set size; it cannot check a password against known breach databases or detect predictable patterns like keyboard walks or dictionary words.
Sources: NIST SP 800-63B - Digital Identity Guidelines: Authentication and Lifecycle Management
Last updated: 2026-08-17