Free · in-browser · nothing transmitted
16-Character Password Generator
A truly random 16-character password, generated on your device with cryptographic randomness. Adjust the character types below — the strength meter shows exactly what each choice costs or buys.
Short answer
A random 16-character password using upper and lower case, digits and symbols carries about 103 bits of entropy — very strong. That is beyond any realistic guessing attack, online or offline, for the foreseeable future. Every password here is generated in your browser and never leaves it.
Pool: 85 characters · entropy = length × log2(pool)
Generated on your device with cryptographic randomness — never sent, stored, or logged.
About the numbers
Length is the cheapest security you can buy: each added character multiplies the search space by the pool size, so going from 16 to 20 characters costs nothing to store in a password manager and multiplies an attacker's work millions of times. If a site rejects symbols, keep the length and drop the symbols — the table shows that trade precisely.
16-character password strength by character set
| Character set | Entropy | Rating |
|---|---|---|
| Lowercase only | 75 bits | Strong |
| Upper + lower | 91 bits | Very strong |
| Letters + digits | 95 bits | Very strong |
| All characters | 103 bits | Very strong |
Entropy = length × log2(pool size), assuming truly random draws. Every character type you allow multiplies the attacker's search space.
Password strength by length (entropy bits)
| Length | Letters + digits | All characters | Rating (all chars) |
|---|---|---|---|
| 8 characters | 48 bits | 51 bits | Fair |
| 10 characters | 60 bits | 64 bits | Strong |
| 12 characters | 72 bits | 77 bits | Strong |
| 14 characters | 83 bits | 90 bits | Very strong |
| 16 characters | 95 bits | 103 bits | Very strong |
| 20 characters | 119 bits | 128 bits | Very strong |
| 24 characters | 143 bits | 154 bits | Very strong |
| 32 characters | 191 bits | 205 bits | Very strong |
Entropy = length × log2(character-pool size); each +10 bits multiplies the guessing work ~1,000×. Ratings assume a truly random password — human-chosen ones are far weaker at the same length.
How we calculate this
How the generator works, and why the details matter:
- Cryptographic randomness. characters are drawn with crypto.getRandomValues using rejection sampling — the browser's CSPRNG, with the modulo bias removed. Math.random() is never used.
- Class guarantee. one character from every selected type is placed first, the rest drawn from the full pool, then the order is shuffled (Fisher–Yates) — so 'must contain a digit' rules always pass without weakening randomness.
- Strength (entropy). bits = length × log2(pool size). 16 characters over the full pool is ~100+ bits — far beyond any online guessing attack; passphrases add 8 bits per word from a 256-word list.
Assumptions
- Generation happens entirely in your browser: no network request carries the password, nothing is stored, and reloading the page destroys it.
- Entropy ratings assume the attacker knows the generator's rules but not the random draws — the standard (Kerckhoffs) assumption.
- Some sites cap length or ban symbols; the options exist to fit their rules, and the table shows what each restriction costs in bits.
- A password manager is assumed as the storage strategy — these passwords are not designed to be memorized (that's what the passphrase mode is for).
Sources
Last reviewed: July 22, 2026
Frequently asked questions
Is it safe to use an online password generator?+
It depends entirely on where the password is made. This one is generated inside your own browser using crypto.getRandomValues — the page makes no network request with the password, nothing is stored or logged, and reloading destroys it. You can verify that in your browser's network tab: generating produces zero requests. A generator that creates passwords on a server, by contrast, has seen every password it ever made.
How long should a password be?+
For anything stored in a password manager: 16+ characters with all character types (~100 bits of entropy) — beyond realistic attack. 12–14 characters is a reasonable floor for accounts with lockout protection. Below 10, offline cracking gets cheap: an 8-character password, even fully random, falls to serious hardware in days. Length beats complexity — each extra character multiplies the attacker's work by the whole pool size.
What makes a password strong?+
Genuine randomness, then length. Strength is measured in entropy bits — length × log2(pool size) — and only holds if every character is truly random. Human patterns (words, dates, keyboard walks, 'P@ssw0rd1!' substitutions) collapse the real search space by orders of magnitude, which is why cracking tools try them first. A random 12-character password beats a clever-looking 20-character one built from words and birthdays.
Password or passphrase — which should I use?+
Both, for different jobs. Random character passwords are for everything your password manager fills automatically — memorability is irrelevant there. A passphrase (several truly random words) is for the handful of secrets you must type or remember: the manager's master password, disk encryption, your computer login. From this tool's 256-word list, 8 random words give ~64 bits — strong, and vastly easier to type than 11 random symbols.
Should I avoid ambiguous characters like l, 1, O and 0?+
Only when a human will read or type the password off a screen or paper — the 'avoid ambiguous' option removes Il1O0 so transcription can't go wrong. It costs a little entropy (a slightly smaller pool), which the strength meter reflects honestly. For passwords that only ever live in a manager and autofill, leave every character in.
How should I store the passwords I generate?+
In a password manager — that is the assumption this whole tool is built on. A manager lets every account have a unique random password, which turns a site breach from a catastrophe into a non-event, and its autofill also protects against phishing look-alike domains. Protect the manager itself with a strong passphrase and two-factor authentication, and let it hold everything else.
Also try the Password Generator.