How each password is generated
Every character is picked at random from the ones you have ticked, using the browser’s cryptographic generator (crypto.getRandomValues). We do not use Math.random, which is predictable, nor a bare modulo operation, which makes some characters come up slightly more often than others. We throw away the values that would cause that bias and draw again.
If you tick several character types, the password contains at least one of each, because many sites require it. We do not do that by putting a digit in a fixed position: we generate the whole password and, if a type is missing, discard it and draw a new one. The result stays uniform, with no predictable spots.
That requirement removes some combinations, and the bit counter accounts for it. With 16 characters and all four types you get 104.6 bits, not the 104.9 that 16 × log₂(94) would give. It is a small difference, but we prefer not to round in our favor.
Which length to choose
Length matters more than anything else. Each extra character multiplies the combinations by 94; adding symbols to a short password helps far less. These are the figures with all four character types:
| Length | Bits | Average time | Sensible use |
|---|---|---|---|
| 8 | 51 | 1 day | None: it is too short |
| 12 | 78 | 5,277 centuries | Bare minimum, with two-factor authentication |
| 16 | 104 | more than 100 million years | Any account saved in a password manager |
| 20 | 130 | more than 100 million years | Our default |
| 32 | 209 | more than 100 million years | API keys, backup encryption |
The figures for every length, every kind of password and faster or slower attacks are in the guide how long it takes to crack a password.
What current standards say
NIST’s guideline (SP 800-63B, revised in 2025) is the reference banks and governments follow. It has dropped several habits that many sites still enforce:
- Length over complexity. If the password is the only protection on the account, it must be at least 15 characters. With two-factor authentication, at least 8.
- No mandatory composition rules such as “one capital, one number and one symbol”. They push people towards Password1!.
- No periodic expiry. Change it only when there is evidence it has leaked.
- Check against lists of breached passwords before accepting them. That is what our checker does.
A random 20-character password more than meets all of that. The only job left for you is using a different one for every account and keeping them in a password manager.
Why numbers and symbols are colored
So you can read the password without mistakes when you cannot copy and paste it: on a TV, in a router’s settings or when reading it out. Teal marks numbers and amber marks symbols, so an O is never mistaken for a 0. If that is still tricky, tick “avoid look-alikes”.
Frequently asked questions
Is it safe to generate a password on a website?
It depends on where it is generated. Here it is created inside your browser with crypto.getRandomValues, the same generator password managers use, and it never reaches our server. You can check: load the page, disconnect from the internet and keep generating. It works the same.
Do you store the passwords I generate?
We could not even if we wanted to: they never leave your device. There are no cookies, analytics or ads either. The only thing saved, and only in your browser, is your settings (length and character types) so you find them the same next time. The ones you copy appear in the history in the header while the tab is open and are erased when you close it.
How many characters should a strong password have?
For an ordinary account saved in a password manager, 16 characters with every type gives about 104 bits, which is plenty. We suggest 20 because it costs nothing: you will not be typing it. The US reference standard (NIST SP 800-63B) asks for at least 15 characters when the password is the only thing protecting the account.
Should I change my passwords every few months?
That is no longer the advice. Scheduled changes push people into predictable variations (Summer2025!, Summer2026!). What you should do is change a password as soon as there is any sign it has leaked. You can check with our password checker.
Why do the bits drop when I tick “avoid look-alikes”?
Because there are fewer characters to choose from: removing i l 1 I o 0 O leaves 86 instead of 94. At 16 characters you go from 104.6 to 102.5 bits, a difference that does not matter in practice. It is worth it if you will read the password out loud or copy it by hand.
Can I use it for my Wi-Fi password?
Yes. WPA2 and WPA3 accept 8 to 63 characters. For a home router use 20 or more and skip the awkward symbols if you will type it on a TV or a games console. You rarely type it, so length is free.
Where should I keep a password like this?
In a password manager (Bitwarden, 1Password, KeePassXC, or the one built into Apple, Google or Firefox). That way you only have to remember one master password, and for that one a long passphrase you can memorize is the right choice.