Password Generator
Generate strong random passwords. Customizable length, lowercase, uppercase, numbers, symbols.
Free · Runs in your browser · No signup
Examples to try
Local generation
Passwords are created in the browser. Prefer longer passphrases or unique passwords per site with a manager.
Common mistakes
- Reusing one password across many accounts.
- Making passwords short to “remember them all”.
- Storing passwords in plain notes without encryption.
Scope: Convenience generator for personal use. Prefer a dedicated password manager for vaulting.
How to Use
Enter your values in the fields above and click Calculate to get instant results. All computations run locally in your browser. No data is ever uploaded or stored.
Related Calculators
Password Entropy & Strength
CalcSolver builds each password by picking characters from your chosen set using cryptographically secure randomness. Strength is determined by the number of possible combinations — the password's entropy.
Combinations = C^L (character-set size to the power of length)
Bits of entropy = L × log₂(C)
A 14-character password using all 4 character types (94 symbols) has ~92 bits of entropy — computationally infeasible to brute-force.
Password Strength Benchmarks
8 chars, lowercase only (26): ~37 bits — crackable in seconds
12 chars, all types (94): ~78 bits — months to crack
16 chars, all types: ~104 bits — centuries to crack
20 chars, all types: ~130 bits — effectively unbreakable
NIST recommends minimum 8 characters; most experts now recommend 12–16. Use a password manager to handle long, unique passwords.
Understanding Password Entropy
Password strength is measured in bits of entropy, which quantifies the unpredictability of a password. The formula is E = L × log2(N), where L is the password length and N is the size of the character set. Using only lowercase letters (26 characters), each character adds about 4.7 bits. Adding uppercase, digits, and symbols (95 printable ASCII characters) increases each character to 6.6 bits. A 12-character password from a 95-character set has approximately 79 bits of entropy — considered very strong. For comparison, a 4-word passphrase from a 2,000-word list has about 44 bits. The higher the entropy, the more computational effort required to crack the password through brute force.
Character Set Size and Its Impact
The total number of possible combinations grows exponentially with both character set size and password length. A lowercase-only 8-character password has 26^8 = 208 billion combinations. Adding uppercase doubles the set to 52 characters, yielding 52^8 = 53 trillion combinations. Including digits (62 characters) gives 62^8 = 218 trillion. Adding symbols (95 characters) produces 95^8 = 6.6 quadrillion combinations. This demonstrates why including all character types dramatically increases security. However, length matters even more: a 16-character lowercase-only password (26^16) has more combinations than an 8-character password using all 95 characters. When possible, maximize both length and character variety.
Brute Force Time Estimates
Brute force attacks systematically try every possible combination. A modern GPU cluster can test approximately 10 billion passwords per second against common hash algorithms. An 8-character lowercase password (208 billion combinations) would be cracked in about 21 seconds. An 8-character mixed-case, digit, and symbol password (6.6 quadrillion combinations) would take roughly 8 days. A 16-character password with all character types has approximately 4.7 × 10^18 combinations, requiring over 15,000 years at the same rate. These estimates assume offline attacks against stolen hashes. Online attacks against login forms are much slower due to rate limiting and account lockouts, making even shorter passwords harder to crack remotely.
Real-World Examples
Example 1 — Weak Password: "password123" has roughly 37 bits of entropy and appears in every common password list. It would be cracked instantly by any attacker using a dictionary attack or rainbow table.
Example 2 — Moderate Password: "Kj#9mPx2" (8 characters, mixed types) has about 52 bits of entropy. Estimated crack time: several hours to days depending on the attacker's hardware. This level is acceptable for low-risk accounts but insufficient for email or banking.
Example 3 — Strong Password: A 20-character password generated by CalcSolver with all character types enabled has approximately 131 bits of entropy, making brute force computationally infeasible for the foreseeable future. This exceeds the 128-bit security level recommended for sensitive applications.
NIST Password Guidelines and Best Practices
The National Institute of Standards and Technology (NIST) updated its password guidelines in 2024, shifting away from complexity rules toward length and usability. Key recommendations include: passwords should be a minimum of 8 characters for user-chosen passwords and 6 characters for randomly generated ones; maximum length should be at least 64 characters; services should screen new passwords against known breached password lists; and periodic password changes should not be forced unless a breach is suspected. NIST now recommends long passphrases over short complex passwords because length provides more entropy than complexity alone.
Password Managers: Why You Need One
A password manager generates, stores, and auto-fills unique passwords for every account you use. The average person has over 100 online accounts — remembering unique strong passwords for all of them is impossible without a tool. Password managers encrypt your vault with a single master password, which is the only one you need to remember. Reputable managers use AES-256 encryption and zero-knowledge architecture, meaning even the provider cannot access your stored credentials. Popular options include Bitwarden (open source and free tier available), 1Password, and Dashlane. Browser-built-in password managers are convenient but generally less secure than dedicated solutions and do not work across different browsers. Using a password manager combined with two-factor authentication provides the strongest practical defense against account compromise. CalcSolver generates passwords entirely in your browser using cryptographic randomness — nothing is sent to any server. For generating random numeric codes or PINs, try our random number generator.
Sponsored Content
The following content is provided by our advertising partner and does not affect the calculator experience.
Frequently Asked Questions
What is a passphrase?
A passphrase is a sequence of random words used as a password, like "correct horse battery staple." Passphrases are easier to remember than random characters while being equally or more secure.
Are passphrases more secure than passwords?
A 4-word passphrase from a list of 2,000 words has about 44 bits of entropy, comparable to a 7-character random password. But passphrases are much easier to remember, reducing the temptation to reuse passwords.
How many words should a passphrase have?
For strong security, use at least 4-5 random words. Each additional word increases security exponentially. For critical accounts, 6+ words is recommended.
How is password strength measured?
Password strength is measured in bits of entropy using the formula E = L x log2(N), where L is length and N is character set size. Each character from a 95-character set adds about 6.6 bits. A 12-character password has approximately 79 bits of entropy, while a 16-character password has about 105 bits. Higher entropy means more time and computing power needed to crack the password.
How long would it take to brute force a password?
At 10 billion guesses per second (modern GPU cluster), an 8-character lowercase password cracks in 21 seconds. An 8-character mixed-type password takes about 8 days. A 16-character mixed-type password would require over 15,000 years. Adding length is more effective than adding complexity — a 20-character lowercase-only password is stronger than an 8-character password with all character types.
What do NIST password guidelines recommend?
NIST recommends a minimum of 8 characters for user-chosen passwords, screening against known breached password lists, and allowing passwords up to 64 characters. They no longer require periodic forced password changes or mandatory special characters. Long passphrases are preferred over short complex passwords. Using a password manager to maintain unique, strong passwords for each account is the most important security practice.