Home›Generators›Security›Password Generator

Password Generator

Security

Generate strong, random passwords with customisable length and character rules. Works entirely in your browser — nothing is ever stored or transmitted.

Reviewed by the thecalcu.com team · Last updated June 20, 2026

What is a Password?

A Password Generator is a tool that creates strong, random passwords on demand by combining characters from a pool you choose, uppercase letters, lowercase letters, numbers, and symbols. Instead of relying on a person to invent a password (which almost always introduces predictable patterns like birthdays, pet names, or simple keyboard sequences), this tool draws every character independently using your browser's cryptographically secure random number generator.

The result is a password with no exploitable structure. Security researchers consistently find that human-created passwords cluster around a small set of common patterns, which is exactly why credential-stuffing and dictionary attacks remain effective. A generated password sidesteps this entirely, every character is equally likely, so the only way to find it is to try every possible combination, which becomes computationally infeasible once the password is long enough.

For developers creating test accounts, IT teams provisioning new user credentials, or anyone signing up for a new service, the Password Generator removes the temptation to reuse a weak, memorable password. Pair it with the UUID Generator when you also need a unique identifier for the account itself, not just its credential.

Why Use a Password Generator?

Manually inventing a strong password is harder than it sounds, most people default to patterns that feel random but aren't: a word with a capital letter and a number at the end, a year of birth, or a short phrase with predictable substitutions (P@ssw0rd). Attackers know these patterns and build dictionaries specifically targeting them, which is why "random-feeling" human passwords are often cracked in seconds.

A generator removes this bias entirely by drawing characters with true cryptographic randomness. It also solves the practical problem of needing dozens of unique passwords across different accounts, rather than reusing one password everywhere (a single breach away from compromising every account), you can generate a fresh one in seconds for each new sign-up, bank login, or test account you create.

Who Should Use This Generator?

Anyone creating a new online account benefits from generating a unique password rather than reusing an old one or typing something memorable but weak. Developers and QA testers use it constantly to spin up test accounts with throwaway credentials that still meet a system's password-strength requirements. IT administrators use it to provision initial passwords for new employees before they set up multi-factor authentication. Password manager users generate a new password here (or directly in their manager) every time they create an account, since memorability is no longer a constraint once a manager stores it for you.

If you also need a unique technical identifier, for a database record, an API key, or a test object, the UUID Generator is the right companion tool; it produces unique IDs rather than secrets meant to be kept private.

What Insights Does the Password Generator Give You?

The two levers that matter most are length and character pool size. Increasing length has the single biggest effect on strength, each additional character multiplies the number of possible passwords by the size of your chosen pool. A 12-character password using all four character types (94 possible characters per position) has roughly 10^23 possible combinations; extending to 16 characters jumps that to roughly 10^31, astronomically harder to brute-force.

The character-type toggles let you match whatever rules a specific website enforces. Some systems reject certain symbols or require at least one number, toggle the relevant options on or off and the password regenerates instantly to match. If every toggle happens to be switched off, the tool falls back to lowercase letters and numbers so you always get a usable result rather than an error.

How to use this Password calculator

  1. Set the Password Length field to your desired number of characters, 16 or higher is recommended for important accounts.
  2. Toggle Include Uppercase (A-Z) on or off depending on whether the target system allows capital letters.
  3. Toggle Include Lowercase (a-z), Include Numbers (0-9), and Include Symbols (!@#$...) to match the password rules of the account you're creating.
  4. Review the generated password in the result box, it updates instantly whenever you change a setting.
  5. Click the copy icon to copy the password to your clipboard, then paste it into the password field of the account you're setting up. Save it in a password manager rather than relying on memory.

Formula & Methodology

The generator builds a character pool by concatenating the character sets you've enabled:

- Uppercase: A-Z (26 characters)
- Lowercase: a-z (26 characters)
- Numbers: 0-9 (10 characters)
- Symbols: !@#$%^&*()_+-=[]{}|;:,.<>? (26 characters)

For each position in the password, the tool draws one cryptographically random 32-bit integer using crypto.getRandomValues() and reduces it modulo the pool size to pick a character. This is repeated independently for every character, so no position depends on any other.

Entropy measures how hard a password is to guess: it's log2(pool size ^ length) bits. A 16-character password drawn from the full 88-character pool (all four toggles on) has roughly log2(88^16) ≈ 103 bits of entropy, well beyond what any practical brute-force attack can exhaust with current computing power. Even a more modest 12-character password with all toggles on carries about 77 bits of entropy, comfortably strong for most personal accounts.

Frequently Asked Questions

A password generator is a tool that creates random, unpredictable passwords by drawing characters from a pool you control, uppercase letters, lowercase letters, numbers, and symbols. Unlike passwords humans invent (which tend to reuse patterns like names, dates, or keyboard sequences), a generated password has no underlying pattern an attacker can guess, making it dramatically harder to crack.
This Password Generator uses the Web Crypto API's `crypto.getRandomValues()`, a cryptographically secure random number source built into your browser, the same class of randomness used for encryption keys, not the weaker `Math.random()` function. Every character is chosen independently from your selected character pool, so there is no predictable pattern for an attacker to exploit.
Strength comes from length and character variety, not cleverness. A 16-character password drawn from uppercase, lowercase, numbers, and symbols is far stronger than a 10-character password using a memorable phrase, because length and pool size both multiply the number of possible combinations an attacker would have to try.
Set your desired length using the length field, toggle on the character types you want included, uppercase, lowercase, numbers, symbols, and the password updates instantly. Click the copy icon next to the result to copy it to your clipboard.
Yes. Each character type, uppercase letters, lowercase letters, numbers, and symbols, has its own toggle, so you can match the password rules of the specific website or system you're signing up for. If a site disallows symbols, simply turn that toggle off before generating.
Yes, password generation happens entirely inside your browser using your device's secure random number generator. Nothing you generate is ever sent to a server, logged, or stored anywhere; closing the tab leaves no trace of the password you created.
Nothing is stored. This tool has no backend and no database; the password exists only in your browser's memory for as long as the page is open. Once you copy it and navigate away or close the tab, it is gone.
It's theoretically possible but practically negligible. A 16-character password drawn from a 94-character pool has roughly 10^31 possible combinations, far more than the number of passwords ever generated by every user of this tool combined, so a repeat is not something to worry about.
12 characters is a reasonable minimum for most accounts today, but 16 or more is recommended wherever the site allows it, especially for email, banking, and password-manager master passwords. Longer passwords resist brute-force attacks far better than adding complexity to a short one.
Yes, reusing a password means a single data breach on one site can compromise every account that shares it. Generate a unique password per account with this tool and store them in a password manager rather than trying to memorise them all.
A password mixes random characters across multiple character types, while a passphrase strings together random dictionary words (e.g. correct-horse-battery-staple) that are easier to type and remember but still long enough to resist brute-force attacks. Use the [UUID Generator](/uuid-generator/) for unique identifiers, or a dedicated passphrase tool when memorability matters more than raw character density.
Once the page has loaded, yes, all generation logic runs locally in your browser with no further network requests required, so it continues to work even if your connection drops.
Also known as
random passwordsecure password generatorstrong password makerpassword creatorcomplex password generator