Formula
Entropy (bits) = length × log₂(pool size) How it works
Entropy measures how many guesses an attacker would need: every extra bit doubles the work. A 20-character password drawn from all 87 characters here has about 129 bits — far beyond what any computer can brute-force. Length adds entropy faster than variety, so when a site restricts symbols, simply make the password longer.
Each password includes at least one character from every type you selected, which satisfies most "must contain a digit and a symbol" rules, and is shuffled so the guaranteed characters are not in predictable positions. Excluding look-alike characters costs a few bits but helps when a password must be read aloud or typed from paper.
Passwords are generated on your device with crypto.getRandomValues, the browser's cryptographically secure random source, using rejection sampling so every character is equally likely. Nothing is sent over the network or stored. Press regenerate for a new one, and keep it in a password manager rather than reusing it.
Frequently asked questions
How long should my password be?
For an account protected by a password manager, 16–20 random characters is plenty. For a master password you must remember, a passphrase of 5–6 random words (around 65–80 bits) is easier to type and still very strong.
Is the entropy figure accurate for any password?
Only for passwords generated randomly like these. A human-chosen password such as "Summer2025!" has far less real entropy than its length suggests, because attackers try common patterns first.
Is it safe to generate a password on a website?
This page creates the password locally in JavaScript and never transmits it — you can even load the page, go offline and keep generating. Still, only use generators you trust, and save the result straight into your password manager.