Generate strong random passwords, passphrases, or PINs securely in your browser with customizable length and character settings.
Choose a mode and press Generate. Everything happens on this device.
CalculateThisWay generates the password on this device using the browser's cryptographically secure random number generator. The generated secret is not sent to CalculateThisWay, stored in the page URL, or included in analytics.
A strong password should be difficult for someone else to guess or generate before the legitimate user can authenticate. For randomly generated passwords, length and randomness are especially important.
Current NIST guidance places strong emphasis on password length and no longer supports arbitrary composition rules that force every user-created password to contain a particular mix of uppercase letters, lowercase letters, numbers, and symbols. That does not mean numbers and symbols make a random password weaker. A generator can use a large character pool effectively because it is choosing characters randomly rather than asking a person to invent a memorable pattern.
The most important distinction is between a human-chosen password and a randomly generated password. People tend to create predictable patterns. A cryptographically secure generator does not.
CalculateThisWay generates each secret entirely inside your browser using the browser's cryptographically secure random number generator, window.crypto.getRandomValues(). It does not use an ordinary, non-cryptographic pseudo-random number function. It does not send the password to a server. It does not include the password in analytics. It does not save the password in the URL.
You choose settings such as length, uppercase letters, lowercase letters, numbers, and symbols. The browser then securely selects characters from the chosen sets using rejection sampling, a technique that avoids modulo bias so every eligible character has an equal chance of being picked.
If you require at least one character from each selected category, the generator securely selects one guaranteed character from every selected group, securely fills the remaining positions from the combined pool, and then securely shuffles the final order using a Fisher-Yates shuffle driven entirely by crypto.getRandomValues(), never by an ordinary, non-cryptographic pseudo-random function. The generated password remains on your current device unless you choose to copy it.
NIST's current password guidance treats length as a major factor in password strength. A longer random password creates more possible combinations. If a random generator selects from N possible characters for each of L positions, the theoretical search space grows approximately as N raised to the power of L.
That growth is exponential. Adding one extra random character does not merely add N possibilities. It multiplies the existing number of combinations by N. This is why increasing length can make such a substantial difference.
Conceptual illustration only. Bar heights are not to scale and no crack-time estimate is shown. Each added random character multiplies the number of possible combinations rather than simply adding to it.
| Length | Relative Search Space |
|---|---|
| 8 characters | Smallest of the three |
| 15 characters | Much larger than 8 characters |
| 20 characters | Far larger still than 15 characters |
There is no single length accepted by every website. Current NIST SP 800-63B-4 (Final, July 2025) requires password verifiers following the guidance to use a minimum of 15 characters for a password used as a single authentication factor. Passwords used only as part of a multi-factor authentication process may use a shorter minimum, but NIST still sets a floor of at least 8 characters in that situation. Individual websites may use different requirements.
CalculateThisWay defaults to 20 random characters while still allowing shorter or longer outputs, from 8 up to 128 characters, when a service requires them. Common choices include 12-character, 16-character, 20-character, and 32-character passwords. Whenever possible, longer unique passwords are generally preferable to reusing shorter passwords across multiple accounts.
Some websites require them. Modern NIST guidance does not recommend imposing arbitrary composition rules on users choosing their own passwords. That is because people often respond predictably: told to add an uppercase letter, a person may capitalize the first character; told to add a number, they may append "1"; told to add a symbol, they may add "!" at the end.
A secure random generator behaves differently because every character can be selected randomly. If a website requires specific character classes, enable those settings in Random Password mode above. If it does not, length and secure randomness remain the main priorities for a machine-generated secret. You can also generate a password without symbols, or with only letters and numbers, simply by unchecking the groups you do not need.
A random password is generated by a process that does not depend on a person's favorite words, birthdays, pet names, keyboard patterns, or other predictable information. Examples of information you should never turn into a password include your name, a child's name, a birthday, a phone number, an address, the website's own name, or a common phrase.
The Password Generator never asks for personal information in order to create a secret. A secure password does not need to know anything about you.
A passphrase is a password made from multiple words. Randomly selected words can create a long credential that may be easier for some people to type or remember than a long string of unrelated characters. The important word is randomly. A famous quote, song lyric, Bible verse, movie line, or common expression is not equivalent to a passphrase made from independently random words.
Passphrase mode above selects each word securely from a local word list of several hundred common, non-sensitive English words using window.crypto.getRandomValues(), never an ordinary, non-cryptographic pseudo-random function. Passphrase security depends heavily on randomness, the size of the word list, the number of words selected, and uniqueness, not on simply using dictionary words.
Illustrative placeholders only, not real recommended secrets. A random password is a long sequence of individually random characters. A passphrase is a smaller number of independently, randomly selected whole words.
| Format | Structure |
|---|---|
| Random password | Many individually random characters |
| Passphrase | A smaller number of independently random whole words |
Example only. Do not use this exact passphrase. A five-word passphrase selected randomly from this generator's word list might look structurally like "forest-amber-quiet-harbor-42". That specific example is shown only to illustrate structure and separators. It is not a recommendation to use, and copying a published example anywhere defeats the purpose of random generation.
A passphrase can still fail if too few words are used, the words form a predictable phrase, the same passphrase is reused, the service itself is compromised, or the user is tricked by phishing. No password format solves every authentication threat.
For high-value accounts, machine-generated unique passwords are often much harder to guess than human-created passwords of similar length. Humans tend to favor names, words, dates, patterns, repeated substitutions, and familiar keyboard sequences. A secure generator does not need the password to be memorable because a password manager can store it. NIST guidance supports the use of password managers and recommends that services allow password paste and autofill functionality.
A reputable password manager can store unique credentials for different accounts and can generate random passwords. The main advantage is that you do not have to memorize every account password, which makes it more practical to avoid password reuse. The master credential protecting the manager itself needs strong protection. CISA guidance supports using password managers carefully and enabling multi-factor authentication for the password manager when it is supported.
If one password is used on several websites and one site is breached, attackers can try the same email and password combination elsewhere. This is commonly called credential stuffing.
Each account is paired with its own distinct, independently generated password. No actual secret values are shown; labels are placeholders only.
| Account | Password |
|---|---|
| Account A | Unique Password A |
| Account B | Unique Password B (different from A) |
| Account C | Unique Password C (different from A and B) |
Unique passwords limit the damage of one compromised account. Instead of changing the same reused password everywhere after a breach, only the affected account needs that specific credential replaced.
Current NIST verifier guidance does not recommend forced periodic password changes simply because a certain number of days passed. Password changes should occur when there is evidence or reason to believe the credential has been compromised, or when a service otherwise requires a change. Repeated forced changes can encourage predictable behavior, such as changing one password into a near-identical successor, which does not necessarily improve security.
No. NIST explicitly notes that passwords are not phishing-resistant. A very long password can still be given to a fake login page. This is why password security should be combined with stronger authentication practices where available, including multi-factor authentication, security keys, passkeys, and other phishing-resistant authenticators.
A password is one authentication factor and is not phishing-resistant by itself. This generator creates passwords, passphrases, and PINs; it does not replace multi-factor authentication or passkeys where a service offers them.
| Component | Role |
|---|---|
| Password | One authentication factor, not phishing-resistant on its own |
| MFA or passkey | A second, often phishing-resistant factor |
| Combined | Stronger sign-in than a password alone |
A Password Generator solves the problem of generating a difficult-to-guess secret. It does not solve every authentication problem.
Entropy is sometimes used to describe the uncertainty or theoretical search space of randomly generated data. For a uniformly random password with N possible characters and L positions, an approximate information measure is L multiplied by log2(N).
Suppose a password uses all four character groups with no exclusions and no spaces, giving a pool of 87 possible characters (26 uppercase, 26 lowercase, 10 digits, and 27 symbols), at a length of 20 characters. The approximate randomness is 20 × log2(87), which is about 20 × 6.44, or roughly 129 bits. The approximate number of combinations is about 87 to the power of 20, an astronomically large figure expressed here as an estimate rather than an exact count.
That calculation is meaningful only when the selection process actually behaves randomly. It should not be used to pretend a user-created phrase has the same strength as a uniformly random password that happens to share the same length and character types. CalculateThisWay labels this figure as an estimate for the random-generation process, not a universal score for every possible password.
If the algorithm guarantees one character from every selected category, as Require At Least One Character From Each Selected Group does above, the true random distribution is slightly more constrained than a simple pool-size calculation suggests. This generator labels that figure as an approximation rather than an exact value, and prefers the phrase "approximate random search-space strength" rather than claiming guaranteed security.
Ordinary pseudo-random functions built into general-purpose programming languages can be useful for games, visual effects, and simulations. Passwords require stronger randomness. Modern browsers provide Web Crypto, including crypto.getRandomValues(), specifically for obtaining cryptographically strong random values. CalculateThisWay uses that API for every character, word, and digit this tool selects, and for the secure shuffle step used when you require one character from each selected group.
If secure browser randomness is unavailable, this page tells you that secure generation is unavailable in your browser rather than silently switching to a weaker random function.
A PIN uses digits rather than a larger password character set. A six-digit PIN has one million possible values, from 000000 through 999999. That is far smaller than the search space of a long random password. PIN security therefore depends heavily on the system limiting repeated attempts and on the PIN being used in the right context. Random PIN mode above can create the digits securely, but a short PIN and a 20-character random password do not provide equivalent protection.
Copying can be convenient when moving a generated password into a password manager or an account creation form. However, clipboard contents can sometimes be read by other software running on a device. CalculateThisWay never claims copying has zero risk. Copy Password above copies the secret only when you explicitly click the button, and this page avoids storing the secret anywhere else.
This page does not encourage that. For that reason, unlike many CalculateThisWay calculators, Password Generator does not have an Email Result function, and it never places the password inside a share URL. Use a password manager or another appropriately secure storage method rather than sending a generated credential through ordinary email.
A password generator does not need to remember the output. Once generated, the secret remains only in the current page session unless you choose to copy it. This website does not save it in browser storage, send it to analytics, attach it to a URL, send it to a server, or print it in a PDF. This reduces unnecessary exposure.
A useful password generator should be random, local, private, transparent, and easy to customize. For most users, strong account security also means using unique credentials, using a password manager, turning on MFA where appropriate, and using phishing-resistant options such as passkeys when available. A password generator is one part of account security, not the entire solution.
I need a strong random password, passphrase, or PIN created securely in my browser, with no secret saved or sent anywhere.
I want to convert length, weight, temperature, volume, area, or speed between units.
I want to compare times across time zones or schedule something across locations.
I want to convert between Roman numerals and ordinary numbers.
A password generator is a tool that creates passwords using an automated, randomized process instead of asking a person to invent one. This generator runs entirely in your browser and uses the Web Crypto API for randomness.
This generator uses your browser's cryptographically secure random number generator, window.crypto.getRandomValues(), for every character, word, and digit it selects. It avoids modulo bias with rejection sampling and securely shuffles results when you require one character from each selected group.
No. The generated password, passphrase, or PIN is not saved to a server, not stored in browser storage, and not included in analytics. It stays on your device for the current page session unless you choose to copy it.
No. Generation happens entirely on your device. Nothing about the generated secret is sent over the network.
There is no single length required by every website, but current NIST guidance favors at least 15 characters for a password used as a single authentication factor. This generator defaults to 20 characters and supports lengths from 8 to 128.
NIST's current guidance places strong emphasis on length because a longer random password creates a much larger search space for an attacker to work through, and it de-emphasizes older composition rules that force specific character mixes.
Symbols are optional. Modern NIST guidance does not require a specific mix of character types for user-created passwords. For a randomly generated password, including symbols simply adds to the character pool the generator can choose from.
Only if a particular website requires them. This generator lets you enable or disable uppercase letters, lowercase letters, numbers, and symbols independently.
A random 12-character password using a large character pool can still have a meaningful search space, but current NIST verifier guidance favors at least 15 characters for a single-factor password, so 12 characters falls below that guidance.
A random 16-character password from a large character pool has a large approximate search space and exceeds the 15-character floor in current NIST verifier guidance.
A random 20-character password, which is this generator's default, has a very large approximate search space when drawn from a broad character pool and comfortably exceeds current NIST verifier guidance.
A random password is generated by a process that does not depend on names, birthdays, pet names, keyboard patterns, or other predictable personal information. Each character is chosen independently and randomly.
A passphrase is a password made from multiple randomly selected words, joined with a separator. This generator selects each word securely from a locally bundled word list.
This generator supports 4 to 8 words. More words increase the approximate search space, assuming each word is selected independently and randomly.
Neither format is automatically safer. Safety depends on randomness, the size of the word list or character pool, and the length or word count, not on the format alone.
Entropy here describes an approximate information measure for a randomly generated secret, calculated as length multiplied by log2 of the character pool size, or word count multiplied by log2 of the word list size for a passphrase.
No. Actual attack speed depends on the attacker's hardware, method, and the service's own defenses, which this generator cannot know. It shows an approximate search-space size instead of a crack-time estimate.
Crack-time claims depend on assumptions about attacker hardware and attack method that vary enormously and cannot be verified. This generator instead shows length, character pool size, and approximate combinations and bits, labeled clearly as an approximation.
No. Reusing a password across sites means that if one site is breached, attackers can try the same credential elsewhere, a technique known as credential stuffing.
Credential stuffing is when attackers take username and password pairs exposed in one breach and try them against other websites, hoping people reused the same password.
A reputable password manager can store unique, randomly generated passwords for each account so you do not need to memorize them. CISA guidance supports using password managers carefully alongside multi-factor authentication.
Current NIST verifier guidance does not recommend forcing password changes on a fixed schedule like every 30, 60, or 90 days. Repeated forced changes can encourage predictable patterns instead of improving security.
Change a password when there is reason to believe it has been exposed or compromised, or when a service specifically requires a change, rather than on an arbitrary calendar.
No. NIST explicitly notes that passwords are not phishing-resistant. Even a long, randomly generated password can be typed into a fake login page.
MFA, or multi-factor authentication, requires more than one form of proof to sign in, such as a password plus a code or security key, which adds protection beyond the password alone.
A passkey is a phishing-resistant sign-in credential that typically replaces or supplements a password. This generator creates passwords, passphrases, and PINs, and does not replace the need for passkeys or MFA where a service offers them.
A six-digit PIN has far fewer possible combinations than a long random password. Its practical security depends heavily on the service limiting repeated attempts rather than on the PIN alone.
There are 1,000,000 possible six-digit PINs, from 000000 through 999999.
No. This generator uses window.crypto.getRandomValues() exclusively for every random selection, including character choices, word choices, digit choices, and the secure shuffle step. It never uses an ordinary, non-cryptographic pseudo-random function.
Web Crypto is a browser API that includes crypto.getRandomValues(), a source of cryptographically strong random values suitable for generating secrets, unlike ordinary pseudo-random functions.
Yes. Uncheck Symbols in Random Password mode and the generator will only use the character types you leave selected.
Yes. Enable Exclude Similar Characters to remove characters that are easy to misread, such as 0, O, o, 1, l, and I, from the generated output.
Yes. Random Password mode with a long length and a full character pool works well for a WiFi network password, as long as your router accepts the length and characters you choose.
This generator intentionally does not include an email-sharing feature for the generated secret. Sending a generated password through ordinary email is discouraged; consider a password manager instead.
Print or Save as PDF intentionally omits the generated secret and replaces it with a placeholder notice, so the printed page never contains your actual password, passphrase, or PIN.
Copy Page Link only copies this page's web address. Including a generated secret in a shareable link would risk exposing it, so this generator never places it there.