Calculator
What the Password Generator does
Password Generator: generates Password from Length, Uppercase A-Z and Lowercase a-z. Example: length 20, uppercase A-Z Yes and lowercase a-z Yes gives password %;*H8kMRhQ_o^G{?WB?X.
The inputs are Length, Uppercase A-Z, Lowercase a-z and Digits 0-9; the output is Password. Set your values, then run the tool to see the result.
Most people who open the Password Generator are anyone replacing a weak password. A secret that travels to a third-party server is no longer entirely a secret.
Nothing leaves the tab. You can watch your browser network panel while you use it and see for yourself.
The field reference, the method and a worked example using the default inputs follow the tool itself.
What do the Password Generator fields mean?
The Password Generator uses 5 inputs. The page opens in a usable state: real values in, real answer out, ready to edit.
| Field | What to enter | Default |
|---|---|---|
| Length | accepts 4 to 128 | 20 |
| Uppercase A-Z | choose from Yes or No | Yes |
| Lowercase a-z | choose from Yes or No | Yes |
| Digits 0-9 | choose from Yes or No | Yes |
| Symbols !@#$ | choose from Yes or No | Yes |
How does the Password Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
Bad input produces an error, never a confident-looking wrong answer.
Worked example
These are the values the Password Generator loads by default, and the result it produces from them. Below is the same computation the tool performs on load, step by step.
| Length | 20 |
|---|---|
| Uppercase A-Z | Yes |
| Lowercase a-z | Yes |
| Digits 0-9 | Yes |
| Symbols !@#$ | Yes |
| Password | %;*H8kMRhQ_o^G{?WB?X |
|---|
How much entropy this actually buys you
A generated password’s strength is arithmetic: bits of entropy = length × log₂(character-pool size). Every character here comes from crypto.getRandomValues, a CSPRNG, so unlike a password a person chooses from memory, the arithmetic actually holds. Nothing about the result is more predictable than the formula says.
| 8 chars, full 95-character pool | ~53 bits | Weaker than the 12-character password below despite using every symbol on the keyboard |
|---|---|---|
| 12 chars, lowercase only (26) | ~56 bits | Stronger than the 8-character symbol-rich password above |
| 16 chars, letters + digits + symbols | ~105 bits | Comfortably beyond any realistic offline attack |
| 20 chars, same pool (this tool’s default) | ~131 bits | Effectively unattackable with current or foreseeable hardware |
Worth knowing
- Length dominates the equation. Each extra character multiplies the search space by the pool size; each extra symbol option only adds a few bits per character across the whole password. A 12-character lowercase password beats an 8-character password drawn from every symbol on the keyboard.
- A commonly cited reference point for an offline attack against an unsalted, fast hash is on the order of 100 billion guesses per second on a single modern GPU rig. Treat that as an order of magnitude, not a benchmark, since real hardware, the specific hash, and salting all move it by orders of magnitude in either direction.
- That figure only applies if the password ever leaks as a fast, unsalted hash. Stored behind bcrypt, scrypt or Argon2 the same password is attacked at thousands of guesses per second, not billions: see the hash generator and HMAC generator entries below for why that gap exists.
- Composition rules (must contain a symbol, must contain a digit) mostly narrow the space of passwords a human actually picks, without widening the theoretical pool by much, which is why NIST SP 800-63B now recommends length and a breached-password check over composition requirements.
Read next: What Actually Makes a Password Strong
How to use it
- Key in Length (4 to 128).
- Pick a value for Uppercase A-Z: the options are Yes or No.
- Pick a value for Lowercase a-z: the options are Yes or No.
- Pick a value for Digits 0-9: the options are Yes or No.
- Pick a value for Symbols !@#$: the options are Yes or No.
- Press Generate password.
- Read Password in the results panel.
- Copy Link when you want to return to this exact configuration; Print when someone needs it on paper.
What this tool does not do
- Anything generated here is only as safe as wherever you store it afterwards.
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- Where a standard has revisions, the version used is the one named in the method section.
- A plausible-looking answer from the wrong input is still the wrong answer: verify the fields first.
Frequently asked questions
You need Length, Uppercase A-Z, Lowercase a-z, Digits 0-9 and Symbols !@#$. Every box already holds a working value, so you can change one value at a time and watch how the result responds.
Length accepts 4 to 128. The range is enforced before the calculation runs, so a bad entry never reaches the formula.
With the values loaded when the page opens, password comes out as %;*H8kMRhQ_o^G{?WB?X. Adjust any field to see how much the answer depends on it.
No. There is no upload step, no database, and nothing to delete afterwards.
No charge. Everything on the page is available without signing in.
The computation is exact; how much you should trust the answer depends on how good your inputs are.