This tool runs locally in your browser.
Results are estimates based on your input only; entered values and result contents are not stored by BoringToolsKit.
Your inputs and results stay in this browser. This page may send privacy-bounded aggregate interaction events described in Privacy; it does not send your entered values or result contents.
Use this result
Share the current inputs or ask ChatGPT to explain the calculation in context.
What does this calculator estimate?
A password generator creates random, secure passwords from the character sets you choose. Pick a length and enable the character types to generate a strong password locally in your browser.
- Random characters from enabled sets
- 16+ characters recommended
- Entropy = length × log₂(set size)
What makes a password strong
Strength comes from unpredictability, not complexity rules: longer passwords with more possible characters have more entropy (measured in bits). Random generation avoids the patterns humans fall into — dictionary words, dates, and reused passwords are the real risk.
Limitations to watch for
A generated password is only as safe as how you store it — a strong password written on a sticky note is weak. Reusing the same password across sites means one breach exposes everything. This tool generates locally in your browser; nothing is sent or stored.
How to use it in practice
Use 16+ characters with all four character classes for anything important. Store passwords in a password manager so you can use unique, random values everywhere. Enable two-factor authentication for extra protection on critical accounts.
['Choose the length (16+ recommended).', 'Enable the character sets you need.', 'Generate — then copy the password into your password manager.']
How this calculator works
Formula
Passwords are generated by randomly selecting characters from the enabled sets (lowercase, uppercase, digits, symbols), length 6–64. Entropy = length × log₂(character-set size): a 16-character password from 94 printable characters has ≈ 105 bits of entropy.
Worked example
A 16-character password using all four character classes (94 possible characters) has 16 × log₂(94) ≈ 105 bits of entropy — strong against brute force.
Assumptions to verify
- Generation uses a cryptographically random source in the browser.
- The password is stored and managed securely by the user.
- Entropy assumes random, uniform character selection.
Frequently asked questions
How long should a password be?
16 characters or more is a strong default. Length matters more than complexity — each extra character multiplies the possible combinations.
What is password entropy?
A measure of unpredictability in bits: length × log₂(character-set size). A 16-character password from 94 characters has about 105 bits — astronomically hard to brute force.
Should I include symbols?
They add entropy, but length matters more. A 16-character lowercase password is stronger than an 8-character one with symbols.
Is it safe to generate passwords in the browser?
Yes — the tool generates locally and nothing is transmitted. The bigger risk is how you store the password afterward.
Why not reuse the same strong password?
One breached site exposes every account using that password. Use a unique password per site via a password manager.
What about password managers?
Recommended: they store unique random passwords and autofill them, so you only need to remember one master password.
What does NIST recommend?
NIST SP 800-63B now emphasizes length and uniqueness over forced complexity rules, and recommends screening against known breached passwords.
Cite this tool
BoringToolsKit. “Password Generator.” boringtoolskit.com/password-generator/ (reviewed 2026-08-25). Free to reference in articles, syllabi, and answer posts with a link.
Privacy: Inputs and results stay in this browser. Any future sponsored recommendation or advertisement will be clearly labeled and kept separate from the calculation.