FREE TOOL · EVERYDAY

Password Generator

Strong passwords are random, not clever. Pick a length and character sets — the generator uses your browser's cryptographic randomness, guarantees one character from each set, and scores every password in bits of entropy.

109

Your new password

Everything happens on your device — no account, no server, no storage. Generate, copy, done.

How it works: picks come from crypto.getRandomValues() — cryptographic randomness, not the toy Math.random(). The generator takes at least one character from every set you ticked, then shuffles the result, so a 16-character password never accidentally misses a set. Entropy = length × log₂(pool size); strength bands: under 45 bits Weak, 45–70 Fair, 70–90 Strong, 90+ Excellent. Nothing you generate leaves your device.

Length beats cleverness

A password's strength isn't about exclamation marks in clever places — it's about how many guesses an attacker needs. Sixteen random characters from 94 possible symbols give about 104.9 bits of entropy: 2⁰⁰⁸ possibilities, or roughly 4 × 10³¹ guesses. Even at a trillion guesses per second, that's over a trillion years. Your birth year plus an exclamation mark, meanwhile, falls in seconds. Randomness is the whole trick.

Output · formula · meaning

Output	Formula	What it means
Password	crypto-random picks from your sets	The string to use — generated in your browser, never stored or sent.
Entropy (bits)	length × log₂(pool size)	Guessing difficulty: 104.9 bits for the 16-character default.
Strength rating	<45 Weak · 45–70 Fair · 70–90 Strong · 90+ Excellent	A plain-English read of the entropy — the default scores Excellent.
Character pool	sum of selected sets	94 with all four sets — a bigger pool means more bits per character.

Worked example: the 104.9-bit default

All four sets ticked gives a pool of 94 characters (26 + 26 + 10 + 32 symbols). Each character carries log₂(94) ≈ 6.55 bits of entropy, so 16 characters give 16 × 6.55 ≈ 104.9 bits — rated Excellent. Drop to lowercase-only (26 symbols, 4.7 bits/char) and the same 16 characters give just 75.2 bits — still Strong, but you can see what the sets buy you.

Who uses this

New-account creators: one unique, uncrackable password per site — the single highest-value security habit.
Small-business admins: provisioning accounts and Wi-Fi keys without reusing “Company2024!”.
Router & smart-home setup: strong WPA keys you paste once and never type again.
Password-reuse quitters: the fastest way to stop the one habit that defeats every strong password.

Accuracy & limitations

The randomness is cryptographic-grade, but real-world sites have real-world rules: some cap length at 16 or 20, some forbid certain symbols, some still demand “at least one of each” (already guaranteed here). Adjust the sets to fit the site's rules. Random strings are hard to memorize — pair this tool with a password manager rather than your memory. And this generator doesn't check breach lists: a random 16-character password won't be in one, but never reuse an old favorite assuming it's fine.

Rolling dice instead of passwords? The random number generator handles raffles, draws, and decisions with the same fairness guarantee.

Cite this pageBright Side Kit. “Password Generator.” brightoolbox.com, 2026.Bright Side Kit. "Password Generator." https://brightoolbox.com/password-generator/ Accessed October 21, 2026.

Embed this calculator

<iframe src="https://brightoolbox.com/password-generator/" width="100%" height="640" style="border:0;border-radius:12px" title="Password Generator &mdash; Bright Side Kit" loading="lazy"></iframe><p style="font-size:.8rem"><a href="https://brightoolbox.com/password-generator/">Password Generator</a> by Bright Side Kit</p>

Paste this into any web page to embed the live calculator. The “Bright Side Kit” link below it must stay intact.

Frequently asked questions

Are these passwords safe to use?

Yes. They are generated with your browser's cryptographic random number generator — the same class of randomness operating systems use for security keys — and the page works entirely offline on your device. Nothing is sent, stored, or logged anywhere. The one real rule: use each password on exactly one site.

How long should my password be?

Longer beats cleverer. Security researchers (including NIST's current guidance) now emphasize length over complexity: a random 16-character password has about 105 bits of entropy — effectively uncrackable — while an 8-character “clever” one can fall to modern guessing rigs. Pick 16+ for anything that matters, 20+ for email and banking.

Why not just use a memorable phrase?

Memorable phrases are fine as passphrases — four or five random words — but most people pick predictable ones (“correct horse battery staple” is famous, which makes it a bad pick now). Truly random strings have no pattern to guess, which is exactly what this tool makes. The trade-off: store them in a password manager instead of your memory.

What do “bits of entropy” mean?

Entropy measures guessing difficulty: each extra bit doubles the search space. 40 bits (~a trillion guesses) is weak against a determined attacker; 70+ is strong; 90+ is overkill for any password. The meter under your password translates the math into plain English.

Should I avoid similar-looking characters like 0 and O?

For passwords you must type by hand, it helps — that's why some generators offer an “avoid ambiguous” toggle. For copy-paste use, it doesn't matter; every character is equally random. This tool keeps the full sets on by default (bigger pool = more bits per character) since most passwords are pasted, not typed.

Can I reuse one strong password everywhere?

No — reuse is the one thing that defeats a strong password. When (not if) one site leaks its database, attackers try the same email+password on every other site automatically. One unique password per site, stored in a manager, is the whole game.

Do you store the passwords I generate?

No. There is no account, no server call, and no analytics on the password text — the generation happens in JavaScript in your browser tab. Close the tab and the passwords are gone unless you saved them. That's also why there's no “history” feature: a history would be a liability, not a convenience.