Free Password Generator: How Long a Strong Password Should Be

A password is strong for one reason: there are too many possibilities for anyone to try them all. Every character picked at random from the 88 letters, digits and symbols this generator uses multiplies the number of possible passwords by 88. Sixteen characters gives about 1.3 × 10³¹ combinations. The two things that keep that number honest are length and genuine randomness, and the rest of this guide covers both.

How long should a password be?

The most widely used reference is NIST Special Publication 800-63B, the US government's rulebook for how systems should handle logins. Its fourth revision, finalized in 2025, sets these rules for services that accept passwords:

• At least 15 characters when the password is the only thing protecting the account, and at least 8 when it is combined with a second factor such as an authenticator app.
• Allow passwords of at least 64 characters, and do not cut them short.
• No composition rules. Services should not force you to include a capital, a digit and a symbol, because people respond with predictable patterns like Summer2026!.
• No forced changes every 90 days. A password should only have to change when there is evidence it has been compromised.
• Check new passwords against lists of common and previously breached passwords.

Those rules are written for the people who build login systems, but they translate into simple advice for everyone else. Use 15 characters as a floor. Since a password manager will remember it for you, there is little reason not to go to 20. Treat length as the main dial, and use extra character types where a site allows them.

How long would it take to crack?

The chart assumes an attacker has stolen a database of hashed passwords and can test about a trillion guesses per second offline. That is a realistic rate for a small rig of high-end graphics cards against a fast, outdated hash such as MD5. It assumes the full set of 94 printable keyboard characters. Against a service that stores passwords properly, with a deliberately slow hash like bcrypt or Argon2, the attacker is thousands of times slower and every figure gets longer.

The pattern is what matters. Each extra character multiplies the work by the size of the character pool, so going from 8 characters to 12 moves the estimate from an afternoon to millennia. The crack-time line under the generator uses the same assumption with whichever character types you have switched on.

One caveat these numbers hide. They only apply to passwords that are genuinely random. Attackers start with lists of real leaked passwords and common patterns, so a human-chosen 16-character password like Password12345678 falls in seconds. The bigger real-world risk is reuse. If the same password protects two sites and one of them is breached, attackers simply try it on the other, and length makes no difference.

Why the source of randomness matters

Browsers offer two ways to get random numbers. Math.random() is fast and fine for games and animations, but it is not designed to be unpredictable, and MDN's documentation says plainly not to use it for anything related to security. crypto.getRandomValues(), part of the Web Crypto API, draws on the operating system's cryptographic random number generator, which is built for exactly this job.

This generator uses crypto.getRandomValues() for every choice it makes. Two smaller details also matter, and both are handled:

• Picking a character by taking a random number modulo the size of the set makes some characters very slightly more likely than others. The generator throws away the few random values that would cause that bias and draws again.
• When the password must include at least one character of each type you selected, those characters are placed first and then shuffled into random positions using a proper Fisher-Yates shuffle, so they do not always appear at the start.

Everything happens in your browser tab. You can check this by opening your browser's developer tools, switching to the Network tab and pressing Generate new. No request is sent.

Matching a site's password rules

Many sites still have rules NIST now advises against, and the rules change without notice, so the presets above are built around the most common restrictions rather than particular companies:

• Strong: 20 characters using every character type. Use this unless a site complains.
• NIST minimum: 15 characters using every type. The shortest length that meets the current guidance for a password-only login.
• No symbols: 18 letters and digits. For sites that reject some or all symbols. The extra length makes up for the smaller pool.
• Easy to type: 16 letters and digits with look-alike characters (0, O, 1, l, I) removed. For passwords you may have to read aloud or type on a TV remote, such as a Wi-Fi key.

If a site rejects a password, its error message usually says why. The common causes are a maximum length (some older systems stop at 16 or 20 characters), a symbol it does not accept, or a rule that the password must start with a letter. Shorten it, switch to No symbols, or press Generate new until the first character is a letter. The site's own sign-up page is the only reliable source for its current rules.

Random characters or a passphrase?

A passphrase is a string of randomly chosen words, such as orbit-cactus-lantern-velvet-shrug-pillow. It can be every bit as strong as a random password, as long as the words really are picked at random and not by you. Six words drawn from the EFF's 7,776-word list give about 77.5 bits of entropy. Twelve characters from this generator's 88-character set give almost exactly the same, 77.5 bits.

Use random characters for anything stored in a password manager, since you never have to read or type them. Use a passphrase for the few passwords you must remember and type yourself, such as the master password for the manager or your computer login.

Storing what you generate

A random 20-character password is impossible to remember, and you should not try. Save it in a password manager the moment you generate it, then let the manager fill it in. Bitwarden, 1Password and the managers built into Chrome, Safari, Firefox and Edge all work this way, and most will also warn you about reused or breached passwords.

Where a service offers a passkey, consider using that instead. A passkey replaces the password with a key stored on your device, so there is nothing to guess, reuse or type into a fake login page. For everything else, turn on two-factor authentication with an authenticator app wherever it is available.

Frequently asked questions

Is it safe to generate a password in a browser?

Yes, if the generator uses the Web Crypto API and runs entirely on your device. This one does both: passwords are created in your browser tab with crypto.getRandomValues() and are never sent, stored or logged.

What are the current NIST password requirements?

NIST SP 800-63B Revision 4, finalized in 2025, requires at least 15 characters when a password is the only login factor and at least 8 when it is used with multi-factor authentication. Services should allow at least 64 characters, must not impose composition rules or scheduled password changes, and must check new passwords against lists of common and breached passwords.

How long should my password be?

At least 15 random characters for any account protected by a password alone. If you store passwords in a manager, 20 is a sensible default because you never have to type it.

Do I need symbols in my password?

Not if it is long enough. Symbols enlarge the character pool, which helps, but adding length helps more. An 18-character password of letters and digits is stronger than a 12-character one with symbols. Include them where a site accepts them; leave them out where it does not.

What is the difference between a random password and a passphrase?

A random password is a string of random characters; a passphrase is a string of random words. Six random words from a 7,776-word list are about as strong as 12 random characters. Passphrases are easier to remember and type, random passwords are shorter for the same strength.