A 16-character password drawn from an 87-character pool carries 103.1 bits of entropy. This free password generator makes up to 50 random passwords at once, in your browser. It scores each one in bits, so the strength is a number rather than a colored bar. Nothing you enter reaches our server.

Generated password

Generated password
Generated passphrase
Entropy (bits)
Characters in the pool
Words in the list
Strength

Want a different kind? Change the settings

Examples

Kind

Length

How many

Uppercase A to Z

Lowercase a to z

Digits 0 to 9

Symbols

Avoid look-alike characters (0 O o 1 l I)

How this is calculated

How it works: Every character is drawn from your browser's cryptographic generator with rejection sampling, so each one in the pool is equally likely. Entropy = length × log2(pool size). Passphrase words come from the EFF large wordlist (opens in new window) (7,776 words; Electronic Frontier Foundation, CC BY 3.0 US), drawn the same way: each word adds log2(7,776) = 12.9 bits, and the optional digit adds log2(10) = 3.3 bits. Capital letters and the separator add none, because they are fixed choices.
Privacy: What you enter never reaches our server. It is processed on your device, inside this page.
Corrections: Report a wrong result to media@sqmagazine.co.uk; every report is reviewed and confirmed errors are corrected. Include the inputs and the answer you expected. With your permission, we thank you by name on this page.
Updates: Oct 22, 2026 Published.
Feedback: How useful was this tool?

Table of Contents

How to Use the Password Generator

The password generator takes a length and a set of character types and returns that many random passwords, each with its strength in bits. It draws every character with the browser’s own cryptographic generator, which the W3C describes as a cryptographically strong pseudo-random number generator seeded with truly random values.

Set “Length” to the number of characters you want. The field accepts 1 to 512, and the default of 16 matches CISA’s guidance of At least 16 characters.
Set “How many” to the number of passwords to generate, up to 50 at a time.
Tick the character sets the site accepts: “Uppercase A to Z”, “Lowercase a to z”, “Digits 0 to 9” and “Symbols”.
Tick “Avoid look-alike characters (0 O 1 l I)” if you will read the password aloud or type it from paper.
Read “Generated password”, then check “Entropy (bits)”, “Characters in the pool” and “Strength”. The table below lists every password in the set.

“Copy” puts the password shown in the result on your clipboard, and “Regenerate” draws a fresh set with the same settings. The “Examples” chips load three presets: “Strong password (16 with symbols)”, “API key or token (32 letters and digits)” and “Readable codes (12, no look-alikes)”. “Share result” copies a link that carries your settings, never the passwords, so whoever opens it gets a new set. “Download CSV” saves the list to your device, where it stays readable to anyone with access to that file.

The number under “Entropy (bits)” comes from one short formula.

How Password Strength Is Calculated

Password entropy is the password’s length multiplied by the bits each character carries, and the bits per character are log2 of the pool size. NIST’s Digital Identity Guidelines define entropy as “The amount of uncertainty that an attacker faces to determine the value of a secret.” It adds that “A value with n bits of entropy has the same degree of uncertainty as a uniformly distributed n-bit random value.”

With L as the length and N as the number of characters in the pool:

Bits per character = log2(N).
Entropy = L × log2(N).
Pool with every set ticked: 87 characters (26 uppercase, 26 lowercase, 10 digits and 25 symbols: `!@#$%^&*()-_=+[]{};:,.?/~`).

The formula only describes a password that a machine drew at random. NIST’s informative appendix makes the same distinction: entropy can be readily calculated for data with deterministic distribution functions, while estimating entropy for user-chosen passwords is challenging. A password you invent yourself has no honest bit score, which is why the tool scores only what it generates.

The figure also assumes every character is equally likely and independent of the others. The tool bends that slightly with one rule covered further down. It insists on one character from each set you tick, which trims the exact figure by 0.24 bits.

How the Generator Picks Each Character

The generator turns random bytes into characters without favoring any of them. MDN describes `getRandomValues()` as returning cryptographically strong random values from a pseudo-random number generator seeded with a value with enough entropy. Each draw takes one byte, a value from 0 to 255. Because 256 does not divide evenly by 87, a plain remainder would favor some characters in the pool over others.

The tool keeps a byte only when it’s below 174, two full rounds of the 87-character pool.
It discards the other 82 values, about 32% of all bytes, and draws again.
Every character in the pool then has the same chance on every draw.

The IETF’s RFC 4086 explains why: a password generator needs data that an adversary has a very low probability of guessing or determining. Pseudo-random data based on limited-range sources such as clocks can be searched. By that test, the safest password generator draws from a cryptographic source. It also helps when the generator runs on your own device and shows how it scores the result.

Plug the default settings into that formula and the tool’s own result falls out.

Password Generator Example: 16 Characters, 103.1 Bits

The strong password generator’s defaults are a “Length” of 16, a “How many” of 5, all four character sets ticked and look-alike characters allowed. Five steps rebuild the result panel:

Pool: 26 + 26 + 10 + 25 = 87 characters, matching “Characters in the pool”.
Bits per character: log2(87) = 6.443.
Entropy: 16 × 6.443 = 103.1 bits, matching “Entropy (bits)”.
Label: the figure sits between the tool’s thresholds of 80 and 128 bits, so “Strength” reads Strong.
The summary line under the result repeats the same two numbers: the entropy and the pool size.

The password string changes every time you press “Regenerate”, but the entropy stays at 103.1 bits because it measures the settings, not the particular string. That is also the answer to what a strong password looks like. CISA’s own examples are random strings of mixed-case letters, numbers and symbols, or a passphrase such as “HorsePurpleHatRunBay”, which CISA rates Great. Any password this tool produces at the defaults fits the random-string description.

A score of 103.1 is only useful once you know what the number protects against.

What Your Password’s Entropy Means

Entropy tells you how many guesses a brute-force search needs, and one extra bit doubles that count. The tool’s code turns the figure into four labels. Very strong at 128 bits and above, Strong from 80, Moderate from 60 and Weak below that. The Weak label notes that such a string is fine for a throwaway ID but not for a secret.

The table compares settings the tool can’t show side by side, since it displays one at a time.

Setting	Length	Pool	Entropy (bits)	Tool label
All four sets	12	87	77.3	Moderate
All four sets	13	87	83.8	Strong
All four sets	15	87	96.6	Strong
All four sets (default)	16	87	103.1	Strong
No symbols	16	62	95.3	Strong
Look-alikes removed	16	81	101.4	Strong
API key or token preset	32	62	190.5	Very strong
Readable codes preset	12	32	60.0	Moderate

Source: entropy per NIST’s Digital Identity Guidelines; values computed from length × log2(pool)

Removing look-alikes takes out more than the label lists. Besides 0, O, 1, l and I, the tool also drops the lowercase o, so the full pool falls to 81 characters, not 82.

Entropy also explains why a random password clears a site’s blocklist. NIST requires verifiers to compare new passwords against a blocklist that contains known commonly used, expected, or compromised passwords. Lists like that exist to catch human choices, the reused and predictable passwords tracked in our password statistics. A fresh random string is not one of them.

What a Generated Password Can’t Protect Against

Length and randomness answer one attack: guessing. NIST is plain about the rest: “Keystroke logging, phishing, and social engineering attacks are equally effective on lengthy and complex passwords as they are on simple ones.” A strong password typed into a fake login page is gone the moment you submit it, a pattern covered in how phishing works.

A long random password helps reduce the risk of a guessing attack and does nothing about the others. It belongs alongside a unique password per account and multi-factor sign-in, not in place of them. CISA’s advice is the same: Use a different strong password for each account.

Every added character adds bits to every password, which is why the standards start with length.

How long should a password be?

NIST’s Digital Identity Guidelines require passwords used on their own to be a minimum of 15 characters in length. Verifiers should also permit a maximum password length of at least 64 characters. CISA sets its own bar at At least 16 characters. The tool’s default of 16 meets both.

Source	Minimum	Maximum	Applies to
NIST Digital Identity Guidelines	15 characters	Allow at least 64	Passwords used as the only factor
NIST Digital Identity Guidelines	eight characters	Allow at least 64	Passwords used with multi-factor authentication
CISA	16 characters	None stated	Consumer accounts
This password generator	16 by default	512	Any setting you choose

Sources: NIST Digital Identity Guidelines, CISA Secure Our World

If a site caps length below what you want, every character you lose removes 6.44 bits from the full pool. Short and reused passwords are a recurring theme in the causes of data breaches. Use the longest length a site accepts.

Length is the rule the standards agree on. Character-type rules are where they now say the opposite.

Why the Generator Requires Every Character Type You Pick

When a set is ticked, every password contains at least one character from it. The tool checks each draw and throws away any password missing a chosen set. It redraws the whole string rather than patching one character, so every allowed password stays equally likely. Without the rule, about 14.2% of 16-character passwords from the full pool would have no digit, and sites that demand one would reject them.

The rule has a price, and the tool’s display does not show it.

> By the numbers: On the defaults, the all-sets rule rejects about 15.2% of draws. The passwords that remain carry 102.85 bits of entropy, against the 103.09 bits the formula reports, a cost of 0.24 bits. The exact figure counts every 16-character string that contains all four sets, by inclusion-exclusion over the set sizes.

The standards have moved away from the rule the tool keeps. NIST’s guidelines say verifiers SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords. Its appendix found that the benefit of such rules is less significant than initially thought, with severe costs to usability and memorability.

OWASP’s authentication guidance says There should be no requirement for upper or lower case or numbers or special characters. The UK’s NCSC warns that extra complexity requirements may not provide any more protection.

The tool keeps the rule anyway because many sign-up forms still enforce it. A quarter of a bit is a small price for a password the site accepts. If a site doesn’t require a set, untick it. “Characters in the pool” and “Entropy (bits)” adjust to the smaller pool, and extra length makes up the difference.

Some readers skip symbols for a different reason: they have to type the result.

Random Password vs Passphrase

CISA accepts both: a random string of mixed-case letters, numbers and symbols, or a memorable phrase of 4 to 7 unrelated words. This tool makes the random string. A passphrase trades bits per character for words you can remember. NIST notes that The use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password.

A random string packs the most strength into the fewest characters: 6.44 bits each with the full pool. It suits anything a password manager fills in.
A passphrase’s strength depends on its word count and the size of the word list. Compare list sizes, not character counts.
CISA’s passphrase examples run from “HorsePurpleHatRun” (Good) to a longer six-word version it rates Amazing.

Random Strings and API Tokens

The same generator doubles as a random string and token generator. The “API key or token (32 letters and digits)” preset turns symbols off and reaches 190.5 bits, labeled Very strong. Leaving symbols out avoids characters that need escaping in URLs, shell commands and configuration files. For IDs and test data that guard nothing, a short string labeled Weak is fine, as the tool’s own label says.

Is a 12-character password strong enough?

A 12-character password from all four sets carries 77.3 bits, which the tool labels Moderate. One more character lifts it to 83.8 bits and Strong.

Both fall short of NIST’s minimum of 15 characters for a password used on its own and CISA’s 16. NIST lets passwords used only with multi-factor authentication drop to a minimum of eight characters; behind a second factor, a 12-character password can meet the standard. On its own, take the extra characters.

Does Windows have a built-in password generator?

Microsoft’s built-in option sits in the Edge browser. On a sign-up or change-password form, Password Generator suggests a strong password in a drop-down menu. Edge then saves it and fills it on your signed-in devices.

If the drop-down does not appear, Microsoft says to right-click on the password field and select Suggest strong password. Microsoft’s support page does not publish Edge’s length or character rules, so it gives no bit score to compare against.

Is there anything else my agent or I should know about this page?

Yes. The password generator runs in your browser and nothing you enter reaches our server. It assumes every character is drawn independently and uniformly from the pool. The “Entropy (bits)” it shows is the formula figure, slightly above the exact one once the all-sets rule applies.

The tool generates passwords and nothing else. It doesn’t check a password against breach lists, store anything it generates or make passphrases. It cannot score a password you write yourself.

SQ Magazine publishes this page for information. A long random password helps reduce the risk of guessing attacks; it promises no security outcome and cannot stop phishing or malware.

Conclusion

At the defaults, the password generator draws 16 characters from an 87-character pool for 103.1 bits of entropy, above NIST’s 15-character minimum and CISA’s 16. Anyone setting up an account, a router or a shared login gets a password that meets current guidance. Developers get tokens past 190 bits from the same tool.

Use the longest length a site accepts and untick any character set it does not require. Keep the result in a password manager rather than a notes file; adoption and the browser-versus-manager gap are tracked in our password manager statistics.