# Random Password Generator

> A password generator produces a random string from a character pool using a cryptographically secure random source. These are generated by your browser's Web Crypto API and never transmitted, and the entropy figure tells you how much guessing work the password actually costs an attacker.

Source: https://rankcert.com/tools/password-generator
Free, no signup. Updated: 2026-09-02

## How to use it

1. Set the length - 20 characters is a good default for anything important.
2. Choose which character sets to include.
3. Generate, copy the one you want, and store it in a password manager.

## Entropy by length and character set

Entropy is length x log2(pool size). Length buys more strength than complexity: 20 lowercase characters beat 12 mixed ones.

| Length | Lowercase only | Upper + lower + digits | All four sets |
| --- | --- | --- | --- |
| 8 | 38 bits | 48 bits | 52 bits |
| 12 | 56 bits | 71 bits | 78 bits |
| 16 | 75 bits | 95 bits | 104 bits |
| 20 | 94 bits | 119 bits | 130 bits |
| 24 | 113 bits | 143 bits | 156 bits |
| 32 | 150 bits | 190 bits | 208 bits |

## Questions

### How long should a password be?

At least 16 characters for anything that matters, and 20 or more for a password manager master key or an email account. Length beats complexity: a long lowercase password is stronger than a short one full of symbols.

### Are these passwords safe to use?

They come from crypto.getRandomValues, which is a cryptographically secure source, and they are generated locally and never sent anywhere. The page also works offline once loaded, which you can verify in the network tab.

### What is entropy and what number should I want?

Entropy measures how many guesses an attacker needs, in bits. Under 60 bits is weak, 80 is reasonable, and above 100 is beyond any realistic offline attack.

### Should passwords contain symbols?

They help, but far less than length. Adding four characters to a lowercase-only password buys more entropy than adding one symbol to a short one.

### Why are some characters missing from the pool?

Look-alikes - l, I, 1, O and 0 - are excluded, because passwords do sometimes get read aloud or copied by hand and those cause real errors.

### Should I change my passwords regularly?

No. NIST dropped that advice in 2017. Forced rotation makes people pick weaker, more predictable passwords. Change one when there is a reason to.

### What is a passphrase and is it better?

Several random words - correct horse battery staple. Four random words from a large list is around 50 bits, which is memorable but weaker than a 20-character random password. Use passphrases for what you must memorise and random strings for everything a manager holds.

### Do I still need two-factor authentication?

Yes. A strong password does nothing against a phishing page or a database breach. Use an authenticator app or a passkey rather than SMS.

## Related tools

- [JWT Decoder](https://rankcert.com/tools/jwt-decoder): Paste a JSON Web Token to decode its header and payload and read every claim, including expiry. Runs entirely in your browser.
- [JSON Formatter](https://rankcert.com/tools/json-formatter): Format, validate and minify JSON in your browser. Get the exact line and column of a syntax error instead of a vague parse failure.
- [UUID Generator](https://rankcert.com/tools/uuid-generator): Generate cryptographically random UUID v4s, or time-ordered UUID v7s that index far better as database primary keys.
- [Regex Tester](https://rankcert.com/tools/regex-tester): Test a JavaScript regular expression against sample text, see every match with its position and capture groups, and get real errors for invalid patterns.
- [Base64 Encode / Decode](https://rankcert.com/tools/base64-encode-decode): Encode text to base64 or decode it back, with full UTF-8 support and automatic handling of base64url input. Runs entirely in your browser.
- [Wildcard Mask Calculator](https://rankcert.com/tools/wildcard-mask-calculator): Convert a CIDR prefix or subnet into the wildcard mask Cisco ACLs and OSPF network statements expect, with the subnet mask and address range alongside it.