Random Password Generator

Create a unique, cryptographically random password of up to 64 characters in one click.

Last updated:

Was this calculator helpful?

★ ★ ★ ★ ★
Embed this calculator

Calculation Examples

Calculation Case Result
12 characters, all types Example: 4#kL9!pQ2$vN (78.7 bits entropy)
16 characters, all types Example: mR7@Xq2!sK9#fP4n (104.9 bits entropy)
20 characters, all types Example: Vq8#tN2!wR5$kM9@bX4e (131.1 bits entropy)
4-word Diceware passphrase Example: lantern-coast-oak-fabric (51.7 bits, easier to remember)
Mihail Doncenco
Mihail Doncenco Site Creator & Calculator Expert

Founder and developer of CalcMate. Builds and maintains every calculator on this site, focusing on formula accuracy and clear, practical results.

How to Use the Random Password Generator

Choose the password length. Sixteen characters is a solid default for most accounts; use 20 or more for primary email, banking, and your password manager. Select the character types to include: uppercase letters, lowercase letters, numbers, and symbols.

Enable "Exclude Similar Characters" if you will type the password by hand. It removes look-alike pairs (1 and l, 0 and O, I and |) and costs very little strength: dropping six characters from a 94-character pool lowers entropy by about 0.1 bit per character. Click "Generate" to produce a cryptographically secure password, copy it, and store it in a password manager. Never reuse a password across accounts: credential stuffing attacks replay credentials from one breach against many other sites.

The Science of Password Entropy

Entropy, measured in bits, shows how many guesses an attacker needs in the worst case: a password with \(E\) bits takes up to \(2^E\) guesses. For a password of \(L\) characters drawn at random from a pool of \(R\) characters: \[E = L \times \log_2(R)\] The full set of 94 printable ASCII characters gives \(\log_2(94) \approx 6.55\) bits per character. That makes a 12-character password about 78.7 bits, a 16-character password about 104.9 bits, and a 20-character password about 131.1 bits. Each extra character adds roughly 6.55 bits; each extra character type enlarges the pool, which adds far less.

Here is what those bits mean in practice. A single NVIDIA RTX 4090 tests about 155.9 billion MD5 hashes per second (Hashcat benchmark, 2023). At that speed, exhausting all \(94^8 \approx 6.1 \times 10^{15}\) eight-character passwords takes about 11 hours, while exhausting \(94^{12} \approx 4.76 \times 10^{23}\) twelve-character passwords takes about 97,000 years. Attackers scale this linearly: 1,000 cards cut it to roughly 97 years against an unsalted fast hash, so use 16 or more characters for accounts that matter. Slow hashes such as bcrypt cut the same card to about 184,000 guesses per second, roughly 850,000 times slower.

NIST SP 800-63B-4 (July 2025) puts length ahead of composition rules: at least 15 characters when a password is the only login factor, at least 8 when it is paired with multi-factor authentication, and support for 64 characters or more. This tool draws every character from a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) fed by operating system entropy, so each choice is statistically unpredictable.

Random password generator diagram: entropy in bits and CSPRNG character selection

Useful Tips 💡

  • Store generated passwords in a password manager such as Bitwarden, 1Password, or KeePass. It lets you use a unique 20-character random password on every account without memorizing any of them.
  • Keep all four character types on unless a site rejects certain symbols. A 16-character password using only lowercase letters has about 75.2 bits of entropy versus 104.9 bits with the full 94-character set. If a site caps length at 12, keep every type on to stay near 78.7 bits.
  • Turn on multi-factor authentication or passkeys for email and financial accounts. A strong password still falls to phishing, and a second factor covers that gap.

📋Steps to Calculate

  1. Set the length: 16 characters for most accounts, 20 or more for email, banking, and password managers.

  2. Select character types: uppercase, lowercase, numbers, and symbols. More types enlarge the pool and raise entropy.

  3. Click "Generate", copy the result, and paste it straight into your password manager.

Mistakes to Avoid ⚠️

  1. Reusing passwords across accounts. One data breach at one service exposes every account that shares the password, and credential stuffing tools automate the replay at scale.
  2. Using only lowercase letters or digits. At 12 characters, lowercase only gives 26 options per position: about 95 quadrillion combinations versus about 476 sextillion with the full 94-character set, roughly five million times more.
  3. Saving passwords in plaintext: browser bookmarks, email drafts, notes apps, or spreadsheets. One compromised device then exposes every credential. Use an encrypted password manager with a strong master password.
  4. Generating passwords with a non-cryptographic random generator, such as JavaScript Math.random(). Its output can be predicted once the internal state is inferred. Use only CSPRNG-based generators.

Practical Applications📊

  1. Create unique passwords for email, banking, and social media accounts. Reuse is the weak point: credential stuffing only works when the same password opens more than one site.

  2. Set Wi-Fi and router admin passwords. WPA2 and WPA3 passphrases accept 8 to 63 characters, so a random 20-character passphrase fits and resists offline guessing of captured WPA2 handshakes.

  3. Generate API keys, application secrets, and temporary tokens of 32 or more characters where unpredictability is a security requirement.

Questions and Answers

How does password length affect security?

Each added character multiplies the number of possible passwords by the pool size \(R\), so security grows exponentially with length. With a 94-character ASCII set, every extra character multiplies the search space by 94 and adds about 6.55 bits. Going from 12 to 16 characters raises combinations from \(94^{12} \approx 4.76 \times 10^{23}\) to \(94^{16} \approx 3.72 \times 10^{31}\), a factor of \(94^4 \approx 7.8 \times 10^7\), about 78 million times more. Against an unsalted MD5 hash on one RTX 4090 (155.9 billion guesses per second in Hashcat), an 8-character password from the full set falls in about 11 hours, while 12 characters take about 97,000 years. NIST SP 800-63B-4 (2025) sets a minimum of 15 characters when a password is the only login factor and 8 when it is paired with multi-factor authentication.

Is a 12-character password strong enough in 2026?

Yes, a random 12-character password with all four character types is strong for most consumer accounts, with about 78.7 bits of entropy, but NIST SP 800-63B-4 (2025) sets 15 characters as the minimum for passwords used as the only login factor. In the worst case, one RTX 4090 needs about 97,000 years to exhaust \(94^{12}\) combinations against a fast unsalted hash, and sites that store passwords with slow, salted hashes such as bcrypt or Argon2 make it far longer. The realistic risks are reuse, phishing, and malware, not brute force. For primary email, banking, and password manager master passwords, use 16 to 20 characters (104.9 to 131.1 bits) and turn on multi-factor authentication.

Should I use a password manager with generated passwords?

Yes, a password manager is the practical way to use a unique random password on every account, because it remembers them for you. It stores credentials in an encrypted vault unlocked by one master password or biometrics, and NIST SP 800-63B-4 (2025) requires services to allow password managers and pasting. Leading options include Bitwarden (open-source, independently audited), 1Password (polished cross-device sync), and KeePass (offline, local storage). Protect the vault with a Diceware passphrase of 6 or more words (about 77.5 bits) plus multi-factor authentication, since it guards every other credential. Browser-built-in managers still beat reusing passwords, though dedicated managers usually add stronger vault controls and cross-browser support.

What is a CSPRNG and why does it matter for password generation?

A CSPRNG is a random number generator designed so that no practical computation can predict its next output from earlier outputs, which makes it the only acceptable source for passwords. Ordinary generators such as JavaScript Math.random() or the Python random module are built for speed and statistical spread, and their future output can be reconstructed from a modest sample of past output. A CSPRNG draws entropy from operating system sources (interrupt timing, hardware noise, disk timing) through interfaces like /dev/urandom on Linux, crypto.getRandomValues() in browsers, or the Python secrets module. The cost of getting this wrong is real: a 2006 Debian change to OpenSSL (CVE-2008-0166) crippled random seeding, so only 32,767 distinct keys could be generated per key type and size, and every affected key became guessable.

What is a random password generator and why is it essential?

A random password generator is a tool that creates unpredictable passwords of a chosen length and character set using a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG), so the output cannot be predicted from earlier results or from knowledge of the algorithm. It is essential because human-chosen passwords follow patterns that attackers try first. In the 2009 RockYou breach of 32 million accounts, about 0.9% of users picked 123456 (Imperva analysis, 2010), and dictionary words, names, dates, and keyboard walks are the other common patterns. A password that looks complex to a person can still fall quickly to a dictionary attack.

What is password entropy and how is it calculated?

Entropy is a measure, in bits, of how unpredictable a password is, calculated as \(E = L \times \log_2(R)\), where \(L\) is the number of characters and \(R\) is the size of the character pool. For the 94-character printable ASCII set, each character contributes \(\log_2(94) \approx 6.55\) bits, so a 12-character password has about 78.7 bits. A target of 128 bits, the key strength of AES-128, needs \(128 / 6.55 \approx 19.5\), so 20 characters. The formula only holds for truly random choices: a human-chosen "complex" password such as Summer2026! has far fewer effective bits than its pool size suggests, because attackers try patterns like word, year, symbol first.

What is the difference between a random password and a passphrase?

A random password is a string of randomly chosen characters, while a passphrase is a string of randomly chosen words; at equal entropy the passphrase is longer but easier to remember. With the 7,776-word Diceware list, each word adds \(\log_2(7776) \approx 12.92\) bits, so 4 words give about 51.7 bits, 5 words about 64.6, 6 words about 77.5, and 7 words about 90.5. A 6-word passphrase therefore matches a 12-character random password (about 78.7 bits). The words must be picked by dice or software, not by you: xkcd comic 936 estimated about 44 bits for correct-horse-battery-staple because it assumed a 2,048-word list and 4 words. Use a random password for anything a manager stores, and a passphrase for credentials you must type from memory.
Disclaimer: This calculator is designed to provide helpful estimates for informational purposes. While we strive for accuracy, financial (or medical) results can vary based on local laws and individual circumstances. We recommend consulting with a professional advisor for critical decisions.