Password Generator
This password generator creates random passwords based on the length and character types you choose. You can include lowercase letters, uppercase letters, numbers, symbols, and an option to remove lookalike characters such as O and 0. That makes it useful when you need a password that is harder to guess but still easier to read and save correctly. A generated password usually beats a homemade one because it avoids names, dates, keyboard patterns, and other habits people repeat without noticing. This tool also estimates entropy from the active character pool and your chosen length, then labels the result with the same strength bands used in the code. Use it for email, shopping, work, hosting, or admin accounts where password reuse creates unnecessary risk. The safest routine is simple: generate a fresh password, save it right away in a password manager, and use a different one for every login.
Quick answer
The tool builds a character pool from the options you select, then picks random characters from that pool to create the password.
What this tells you
- •The tool builds a character pool from the options you select, then picks random characters from that pool to create the password.
- •Lowercase adds 26 possible characters, uppercase adds 26, numbers add 10, and symbols add 29 based on the current formula file.
- •If you turn on Exclude Similar Characters, the generator removes i, l, I, 1, L, o, O, and 0 from the active pool before calculating entropy.
- •The entropy score shown here is an estimate based on length and pool size. It helps compare setups, but it does not measure phishing risk, malware, or poor storage habits.
- •When you request multiple character types, the generator retries until the finished password contains at least one character from every selected group.
- •In normal browser use, randomness comes from `crypto.getRandomValues` when that API is available, which is the secure path the page is built around.
- •Longer passwords usually improve security faster than small tweaks to symbols alone, especially when you already use a broad character mix.
How to Use
- 11. Enter a password length from 4 to 128 characters. A length of 16 or more is a sensible default for most modern accounts.
- 22. Turn lowercase, uppercase, numbers, and symbols on or off based on the site rules you need to satisfy.
- 33. Switch on Exclude Similar Characters if you want to avoid lookalike characters that are easy to misread when copying by hand.
- 44. Generate the password and review the entropy score, strength label, and pool size shown with the result.
- 55. If the target site blocks certain characters, adjust the options and generate again instead of editing the password manually.
- 66. Copy the password only when you are ready to save it in a password manager or another secure storage method.
- 77. After you save it, use that password for one account only so a future breach in one place does not spill into others.
How It Works
Formula
Pool size = lowercase count + uppercase count + number count + symbol count
If Exclude Similar Characters is on, remove i, l, I, 1, L, o, O, and 0 from the active pool before counting
Entropy bits = floor(length × log2(pool size))The generator first builds a pool of allowed characters from your checkbox choices. In the current implementation, lowercase contributes 26 characters, uppercase contributes 26, numbers contribute 10, and symbols contribute 29. If you enable Exclude Similar Characters, the tool removes the lookalike characters from whichever sets are active and then recounts the pool. Once the pool size is known, the entropy estimate is the password length multiplied by log2 of that pool size, rounded down with `Math.floor`. The strength label comes from fixed thresholds in the code. Fewer than 28 bits is Very Weak, 28 to 39 is Weak, 40 to 59 is Moderate, 60 to 79 is Strong, 80 to 127 is Very Strong, and 128 or more is Unbreakable. The generator also checks the finished password and retries when needed so every selected character type appears at least once. That matters because a setting like lowercase plus numbers should not accidentally return a result with letters only.
Calculation note: values are processed in the order shown above, using the current input units.
Worked Examples
16 characters with lowercase, uppercase, numbers, and symbols
This setup uses all four character groups, so the pool is 26 + 26 + 10 + 29 = 91 characters. The formula returns floor(16 × log2(91)) = floor(104.11) = 104 bits. Because 104 falls between 80 and 127, the tool labels it Very Strong. The exact password text is random each time, but the pool, entropy, and strength math stay the same for this setup.
12 characters with letters and numbers only
Lowercase plus uppercase plus numbers gives a pool of 26 + 26 + 10 = 62 characters. The entropy estimate is floor(12 × log2(62)) = floor(71.45) = 71 bits. That lands in the Strong band. This is a useful fallback for sites that ban symbols but still allow mixed letters and digits.
20 characters with all groups and similar characters removed
Turning on Exclude Similar Characters removes eight lookalike characters from the full 91-character pool, leaving 83. The entropy estimate becomes floor(20 × log2(83)) = floor(127.50) = 127 bits. That is still Very Strong, but it stays one bit short of the Unbreakable threshold because the code rounds down before labeling the result. This example shows the small tradeoff between readability and total combinations.
8 characters with lowercase only
A lowercase-only password uses a pool of 26 characters. The formula gives floor(8 × log2(26)) = floor(37.60) = 37 bits. Since 37 falls in the 28 to 39 band, the tool marks it Weak. This is a good reminder that short passwords with one character type run out of combinations quickly.
24 characters with lowercase and uppercase letters
Using both letter cases creates a pool of 52 characters. The entropy estimate is floor(24 × log2(52)) = floor(136.81) = 136 bits. Because the score is at least 128, the tool labels it Unbreakable. In practice, this shows how much raw length can compensate when a site limits you to letters only.
Common mistakes
- Choosing a short password for convenience, then assuming a symbol or two makes up for the lost length.
- Turning off symbols or numbers to satisfy a site rule without adding extra length to recover some of the lost search space.
- Editing a generated password into a familiar pattern such as adding a birth year, favorite team, or common suffix.
- Reusing one strong password across many accounts. A single breach can still expose every login that shares it.
- Copying the password before a safe place to store it is open, which increases the chance of losing it and resetting the account.
- Treating the strength label as the whole story instead of also thinking about phishing, device security, and password manager habits.
Embed this calculator on your site
Drop this single line where you want the calculator to appear. It is responsive, mobile-friendly, resizes automatically, and is free to use with attribution.
<script src="https://calctide.com/embed.js" data-tool="password-generator" async></script>Preview the embed at /embed/password-generator/.