Random password generator
Random Password Generator
Generate Strong Random Passwords
Generate long and unpredictable passwords using lowercase letters, uppercase letters, numbers, and symbols. This generator also allows you to exclude visually similar or ambiguous characters when readability is important.
A strong password is more than a combination of uppercase letters, lowercase letters, numbers, and symbols. The most important properties are randomness, length, uniqueness, and secure storage. A password that looks complicated but follows a predictable pattern can still be vulnerable to automated guessing attacks.
Keep Your Password Secret
Never publish, share, or reuse a password generated for a real account. For important accounts, use a password manager and enable multi-factor authentication whenever possible.
What Is a Strong Password?
A strong password should be difficult to predict. The safest approach is to generate it randomly instead of creating it from names, dates, words, keyboard patterns, or other information that an attacker could guess.
For example, adding ! to a common password does not magically make the password random. Attackers know many common password patterns and can prioritize them before attempting every theoretical combination.
Password Length vs. Password Complexity
When a password is generated uniformly at random, the theoretical number of possible passwords can be calculated using the formula NL, where N is the number of available characters and L is the password length.
NL
Theoretical number of possible combinations
This is why increasing the password length can have an enormous effect. Every additional character multiplies the search space by the number of available characters.
Length and Randomness Work Together
A long, genuinely random password is generally much stronger than a short password that merely satisfies rules such as "one uppercase letter, one number, and one symbol."
What Is Password Entropy?
Password entropy describes the amount of uncertainty in a randomly generated password. For an ideal uniformly random generator, entropy can be approximated as:
Entropy = L × log2(N)
L = password length | N = number of available characters
The formula assumes that every character is selected independently and uniformly. A human-created password usually has much less effective entropy because attackers can prioritize words, patterns, leaked passwords, and predictable substitutions.
Password Character Options Explained
This generator uses four primary character groups. The exact character counts below are based on the character arrays used by this password generator.
| Character Type | Characters | Count | Effect on Search Space |
|---|---|---|---|
| Lowercase Letters | a-z | 26 | Adds 26 possible characters. |
| Uppercase Letters | A-Z | 26 | Adds another 26 possible characters. |
| Numbers | 0-9 | 10 | Adds 10 possible characters. |
| Symbols | Generator-defined symbols | 32 | Adds 32 possible characters. |
Character Set Used by This Generator
The 32 symbols configured in this generator are:
( ~ ! < { } ` [ * _ ] , @ " / + > = : ^ . ' ? - | % & ; $ ) \ # What Are Similar Characters?
The Similar Characters option excludes characters that can easily be confused with one another when a password is displayed, printed, or typed manually.
Similar Characters Excluded
This generator excludes:
There are 8 entries in the exclusion list, but the resulting character set loses 7 unique characters because the list contains no duplicate values. Therefore:
What Are Ambiguous Characters?
The Ambiguous Characters option removes symbols that may be difficult to distinguish when passwords are manually read or transcribed.
| Excluded Symbol | Excluded Symbol | Excluded Symbol | Excluded Symbol | Excluded Symbol | Excluded Symbol |
|---|---|---|---|---|---|
| { | / | ' | ~ | . | " |
| ] | , | ( | < | > | \ |
| } | : | [ | ; | ` | ) |
This list contains 18 unique symbols. Because all of these characters belong to the generator's 32-symbol set, enabling Ambiguous Characters reduces the complete 94-character alphabet to:
How Many Characters Does This Password Generator Use?
The following table shows the exact character-set sizes produced by the options in this generator.
| Lowercase | Uppercase | Numbers | Symbols | Similar Exclusion | Ambiguous Exclusion | Final Character Set |
|---|---|---|---|---|---|---|
| ON | ON | ON | OFF | OFF | OFF | 62 |
| ON | ON | ON | ON | OFF | OFF | 94 |
| ON | ON | ON | ON | ON | OFF | 87 |
| ON | ON | ON | ON | OFF | ON | 76 |
| ON | ON | ON | ON | ON | ON | 69 |
| ON | ON | OFF | ON | OFF | OFF | 84 |
| ON | ON | OFF | ON | ON | ON | 59 |
How Many Attempts Does It Take to Crack a Password?
If a password is generated uniformly at random, an attacker who knows the exact character set can theoretically search the entire space. The worst-case number of guesses is:
Number of Attempts = NL
N = available characters | L = password length
The average number of guesses required during an exhaustive search is approximately half of the total search space.
Password Combinations by Character Set
The following table uses the actual character-set sizes of this generator. Values assume uniform random selection and are theoretical search-space calculations.
| Character Set | Characters | 8 Characters | 12 Characters | 16 Characters | 20 Characters |
|---|---|---|---|---|---|
| Lowercase only | 26 | 2.09 × 1011 | 9.54 × 1016 | 4.36 × 1022 | 1.99 × 1028 |
| Lowercase + Uppercase | 52 | 5.35 × 1013 | 3.91 × 1020 | 2.86 × 1027 | 2.09 × 1034 |
| Letters + Numbers | 62 | 2.18 × 1014 | 3.23 × 1021 | 4.77 × 1028 | 7.04 × 1035 |
| All Characters | 94 | 6.10 × 1015 | 4.76 × 1023 | 3.70 × 1031 | 2.88 × 1039 |
| All + Similar Excluded | 87 | 3.27 × 1015 | 2.49 × 1023 | 1.89 × 1031 | 1.44 × 1039 |
| All + Ambiguous Excluded | 76 | 1.11 × 1015 | 6.49 × 1022 | 3.80 × 1030 | 2.22 × 1038 |
| All Exclusions Enabled | 69 | 5.11 × 1014 | 1.74 × 1022 | 5.94 × 1029 | 2.03 × 1037 |
Password Entropy by Character Set
The same character sets can also be compared using theoretical entropy. For an ideal random generator, entropy is approximately L × log2(N).
| Character Set | Characters | Entropy / Character | 12-Character Entropy |
|---|---|---|---|
| Lowercase | 26 | ≈ 4.70 bits | ≈ 56.4 bits |
| Letters + Numbers | 62 | ≈ 5.95 bits | ≈ 71.5 bits |
| All Characters | 94 | ≈ 6.55 bits | ≈ 78.6 bits |
| Similar Characters Excluded | 87 | ≈ 6.44 bits | ≈ 77.3 bits |
| Ambiguous Characters Excluded | 76 | ≈ 6.25 bits | ≈ 75.0 bits |
| Both Exclusions | 69 | ≈ 6.11 bits | ≈ 73.3 bits |
An Interesting Result
Excluding similar or ambiguous characters reduces entropy slightly, but increasing password length can compensate for that reduction very quickly. For passwords stored in a password manager, readability restrictions are usually unnecessary.
How Long Does It Take to Crack a Password?
There is no universal password-cracking speed. The following table is therefore a mathematical illustration, not a real-world cracking benchmark.
Important Assumption
The examples below assume a hypothetical constant rate of 1 billion guesses per second (109/s). Real-world rates can be dramatically different depending on the hashing algorithm, hardware, configuration, and attack type.
| Password | Character Set | Total Guesses | Worst-Case Time at 109/s | Average Search Time |
|---|---|---|---|---|
| 8 characters | Lowercase (26) | 2.09 × 1011 | ≈ 3.5 minutes | ≈ 1.7 minutes |
| 8 characters | Letters + Numbers (62) | 2.18 × 1014 | ≈ 2.5 days | ≈ 1.3 days |
| 8 characters | All Characters (94) | 6.10 × 1015 | ≈ 70.6 days | ≈ 35.3 days |
| 12 characters | Lowercase (26) | 9.54 × 1016 | ≈ 3.0 years | ≈ 1.5 years |
| 12 characters | Letters + Numbers (62) | 3.23 × 1021 | ≈ 102,000 years | ≈ 51,000 years |
| 12 characters | All Characters (94) | 4.76 × 1023 | ≈ 15.1 million years | ≈ 7.5 million years |
| 16 characters | Letters + Numbers (62) | 4.77 × 1028 | ≈ 1.5 × 1012 years | ≈ 7.6 × 1011 years |
| 20 characters | All Characters (94) | 2.88 × 1039 | ≈ 9.1 × 1022 years | ≈ 4.5 × 1022 years |
These Are Not Guaranteed Cracking Times
A real attacker does not necessarily test every possible combination. Human-created passwords can be attacked using dictionaries, leaked password databases, common patterns, personal information, and predictable substitutions.
On the other hand, a properly configured password-hashing algorithm can make offline guessing substantially more expensive than the simple 1-billion-guesses-per-second illustration used here.
Online vs. Offline Password Cracking
Online Attack
- Guesses are submitted to a live service.
- Rate limiting can restrict attempts.
- Account lockouts may stop repeated attempts.
- CAPTCHA and detection systems can interfere.
- MFA can provide another layer of protection.
Offline Attack
- The attacker has obtained password hashes.
- Guesses can be tested without contacting the website.
- Fast algorithms can permit extremely high guess rates.
- Modern password hashing deliberately increases attack cost.
- GPU and specialized hardware can significantly affect speed.
Password Hashing Algorithms and Cracking Speed
The phrase "guesses per second" has no universal meaning unless the password-hashing algorithm and hardware are specified.
| Algorithm | Category | General Security Consideration |
|---|---|---|
| MD5 | General-purpose hash | Too fast for modern password storage. |
| NTLM | Legacy authentication hash | Fast computation makes large-scale offline guessing attractive. |
| PBKDF2 | Password-based key derivation | Uses repeated computational work to increase guessing cost. |
| bcrypt | Password hashing | Designed to make password guessing substantially more expensive. |
| scrypt | Password hashing / key derivation | Uses memory as part of its cost to make large-scale attacks harder. |
| Argon2id | Modern password hashing | Uses configurable time and memory costs and is designed for password storage. |
Is a 12-Character Password Secure?
A 12-character password can be extremely difficult to exhaustively search when it is generated randomly from a large character set. However, 12 characters alone does not guarantee security.
Predictable
Summer2026! This contains several character types but follows an obvious human-created pattern.
Random-Looking
Q7v$2mR9!xL4 This illustrates the type of unpredictable output expected from a random password generator.
What Is the Best Password Length?
There is no single password length that is perfect for every website. Longer passwords generally create a larger search space, and password managers make long random passwords practical.
Short
Smaller search space
Long
Larger search space
Random
Harder to predict
Rather than relying on an arbitrary "magic number," use the longest password accepted by the service and prefer randomly generated passwords. A password manager makes this approach much easier.
Best Random Password Generator Settings
| Setting | Recommended | Security Effect | Readability Effect |
|---|---|---|---|
| Password Length | As long as practical | Strongly increases the search space. | Longer passwords can be harder to type manually. |
| Lowercase Letters | ON | Adds 26 characters. | Easy to use. |
| Uppercase Letters | ON | Adds 26 characters. | Easy to use. |
| Numbers | ON | Adds 10 characters. | Easy to use. |
| Symbols | ON | Adds up to 32 characters in this generator. | Some websites may restrict symbols. |
| Similar Characters | Optional | Slightly reduces the search space. | Improves readability. |
| Ambiguous Characters | Optional | Reduces the symbol set from 32 to 14. | Improves manual transcription. |
Why Use a Password Manager?
A password manager makes it practical to use a different random password for every account. Instead of memorizing dozens of complicated passwords, the user only needs to protect the password manager itself.
Generate
Create unique random passwords.
Store
Store passwords without reusing memorable passwords.
Protect
Protect accounts with unique credentials and MFA.
Why Is Multi-Factor Authentication Important?
A strong password is important, but it is only one part of account security. Multi-factor authentication can provide an additional layer of protection if a password is stolen or exposed.
Defense in Depth
Strong passwords, unique credentials, password managers, MFA, rate limiting, secure password hashing, and breach detection complement one another. No single security mechanism should be considered sufficient by itself.
Password Security Best Practices
Security Checklist
Random Password Generator FAQ
1 0 | l I i O o. The resulting alphabet contains 87 characters. Password Security: The Bottom Line
Use Long, Random, Unique Passwords
The strongest practical approach is to generate a long random password, use it only once, store it securely in a password manager, and enable multi-factor authentication whenever available.
Technical Notes About the Calculations
All combination counts in this article are based on the actual character arrays configured in this generator: 26 lowercase + 26 uppercase + 10 numbers + 32 symbols = 94 characters.
The Similar Characters exclusion removes seven unique characters from the 94-character set, producing 87 characters. The Ambiguous Characters exclusion removes 18 symbols, producing 76 characters. When both exclusions are enabled, the overlap of the | character is counted only once, resulting in 69 characters.
The cracking-time examples assume an artificial constant rate of 109 guesses per second. They are intended to demonstrate exponential growth in the theoretical search space and should not be interpreted as benchmarks for any particular password-hashing algorithm or hardware configuration.
