How the Password Generator Works
A good password is long, random and used only once. People are bad at making these up. We choose names, dates and words, and we follow patterns that attackers know. A password generator does the job better, because it picks every character by chance. The Password Generator makes random passwords in your browser, and it shows how strong each one is.
What you choose
- The length, from 6 to 128 characters. Longer is stronger, and 16 or more is a good choice.
- The kinds of character: capital letters, small letters, numbers and symbols.
- Look-alike characters: you can leave out the ones that are easy to mix up, which are 0, O, 1, l and I. This helps if you have to read or type the password by hand.
- How many passwords, from 1 to 20.
How the password is made
- The generator builds a pool of characters from the kinds that you chose. For example, capital letters, small letters, numbers and 10 symbols give a pool of 72 characters.
- It picks one character from each kind that you chose, so that the password always has at least one capital letter, one small letter, one number and one symbol, if you asked for them.
- It fills the rest of the length with characters picked from the whole pool.
- It shuffles the characters, so that the guaranteed ones are not always at the start.
Every pick uses the secure random number generator of your browser. This is designed for keys and secrets, and it is very different from the ordinary Math.random() function of a program, which is only meant for games and simple effects. The numbers of a simple generator can be predicted from a few earlier numbers, so they should never be used for passwords. The generator also throws away the rare random numbers that would make some characters a little more likely than others, so that every character in the pool has exactly the same chance.
How strength is measured
The strength of a random password is measured in bits. Each bit doubles the number of possible passwords, and so it doubles the work needed to guess it.
bits = length x log2(number of characters in the pool)
The number of bits that each character adds depends on the pool:
| Pool | Characters | Bits for each character |
|---|---|---|
| Numbers only | 10 | 3.32 |
| Small letters | 26 | 4.70 |
| Capital and small letters | 52 | 5.70 |
| Letters and numbers | 62 | 5.95 |
| Letters, numbers and 10 symbols | 72 | 6.17 |
| Letters, numbers and 23 symbols | 85 | 6.41 |
| All printable characters on a keyboard | 94 | 6.55 |
- Pool: Numbers only
Characters: 10
Bits for each character: 3.32 - Pool: Small letters
Characters: 26
Bits for each character: 4.70 - Pool: Capital and small letters
Characters: 52
Bits for each character: 5.70 - Pool: Letters and numbers
Characters: 62
Bits for each character: 5.95 - Pool: Letters, numbers and 10 symbols
Characters: 72
Bits for each character: 6.17 - Pool: Letters, numbers and 23 symbols
Characters: 85
Bits for each character: 6.41 - Pool: All printable characters on a keyboard
Characters: 94
Bits for each character: 6.55
The generator also estimates the time to guess the password. It takes an attacker who can try 10 billion passwords a second, which is possible against a stolen list of passwords that were stored in a fast, weak way. On average, they find the password after trying half of all the possibilities, so the time is 2 to the power of (bits - 1), divided by 10 billion.
A worked example
You make a password of 16 characters, with capital letters, small letters, numbers and the 10 symbols.
| Step | Result |
|---|---|
| Pool | 26 + 26 + 10 + 10 = 72 characters |
| Bits for each character | log2(72) = 6.17 |
| Strength (16 x 6.17) | 98.7 bits, which is very strong |
| Time to guess it (2^97.7 / 10 billion) | about 827 billion years |
Chart: length matters most
The strength in bits for a pool of 72 characters. Red is weak (under 40 bits), amber is fair to strong (40 to 80), and green is very strong (80 and over). Each block is about 3.7 bits.
6 characters ██████████ 37 bits, 7 seconds 8 characters █████████████ 49 bits, 10 hours 10 characters █████████████████ 62 bits, 6 years 12 characters ████████████████████ 74 bits, 31 thousand years 14 characters ███████████████████████ 86 bits, 160 million years 16 characters ███████████████████████████ 99 bits, 827 billion years 20 characters █████████████████████████████████ 123 bits 24 characters ████████████████████████████████████████ 148 bits
Every extra character multiplies the number of possible passwords by 72. Going from 12 to 16 characters makes the password more than 26 million times harder to guess.
Chart: the kinds of character matter less
The strength of a password of 12 characters, for different pools. Each block is about 2 bits.
Numbers only (10) ████████████████████ 40 bits Small letters (26) █████████████████████████████ 56 bits Capital and small (52) ███████████████████████████████████ 68 bits Letters and numbers (62) ████████████████████████████████████ 72 bits With 10 symbols (72) ██████████████████████████████████████ 74 bits With 23 symbols (85) ███████████████████████████████████████ 77 bits All 94 characters ████████████████████████████████████████ 79 bits
Adding symbols helps a little. But making the password longer helps much more. A password of 12 characters with all 94 characters has 79 bits, and a password of 16 characters with only letters and numbers has 95 bits.
The strength meter
The meter under the password goes from 0 to 128 bits. The red zone is weak, the amber zone is fair to strong, and the green zone is very strong. The dark line shows where your password is.
| Bits | Rating |
|---|---|
| Under 40 | Weak |
| 40 to 59 | Fair |
| 60 to 79 | Strong |
| 80 to 99 | Very strong |
| 100 and over | Excellent |
Is it safe to make a password on a website?
The password is made in your own browser, with a program that runs on your device. The generator does not send it to a server, and it does not save it. Even so, only use it as you would any tool: do not use a password that you have seen on a screen shared with other people, and do not reuse it after you have pasted it into an unsafe place. If you want to be extra careful, use the password manager of your device, which can also make random passwords.
Tips for good passwords
- Use a different password for every account. If one site is hacked, the others stay safe.
- Use a password manager. It remembers long random passwords for you, and fills them in.
- Choose 16 characters or more for important accounts, such as email and banking.
- Turn on two-step verification where you can. It protects an account even if the password is stolen.
- Never use personal information, such as names, birthdays and pet names, or a word from a dictionary with a few changes.
- Check the rules of the site. Some do not allow all symbols. Try the option with 10 common symbols, or no symbols.
- Do not send a password by email or chat.
What this generator does not include
- Passphrases made of words, which can be easier to remember.
- A check that the password has not appeared in a data breach.
- Storage of passwords. It cannot recover a password after you leave the page, so save it in your password manager first.
The strength and the time to guess are estimates for a random password. The real safety of an account also depends on how the site stores passwords and on whether you reuse them.