Random Password Generator
Set the length and the kinds of characters you want, then press the button for a fresh random password. Copy it into your password manager and use it for one account only.
Related calculators
Created by the Reeliy Editorial Team. Last updated: Oct 19, 2026
How to use the password generator
Choose a password length, tick the character groups you want, and press Generate Password. A new password appears each time you press the button. The length can be anything from 1 to 500 characters; the default is 16.
Lower-case letters (a to z) are always available. The boxes add more groups to the pool the password is drawn from:
- Include numbers adds the digits 0 to 9.
- Include capitals adds the letters A to Z.
- Include symbols adds
! @ # $ % ^ & * ?. - Include ambiguous characters adds brackets, quotes, slashes and punctuation that some websites and programs refuse or that are awkward to type:
( ) [ ] { } / \ ' " ~ , ; : . < >and the backtick. It is off by default. - Exclude similar characters removes the look-alikes
i,l,1,L,o,Oand0from every group. It is off by default.
Every ticked group is guaranteed to appear at least once as long as the password is long enough to hold one character from each group, which satisfies the common site rule "must contain a number and a symbol". Other than that, each position is chosen independently and uniformly from the full pool.
How the password is generated
The tool draws each character with the cryptographically secure random number generator that browsers provide (crypto.getRandomValues), not with the predictable generator used for games and simulations. When the draw is made, values are rejected and redrawn if needed so that no character is slightly more likely than another.
A direct link to a result carries only the settings you chose, such as the length and the ticked boxes. It never contains the password, so opening it produces a different password. As with any online tool, if you are protecting something critical you may prefer the generator built into your password manager or operating system.
How strong is a random password?
The strength of a truly random password is measured in bits of entropy. If the password has length L and each character is picked from a pool of N possibilities, there are NL equally likely passwords:
entropy (bits) = L × log₂(N)
Every extra bit doubles the number of guesses an attacker needs. The size of the pool depends on the boxes you tick:
| Character groups | Pool size | Bits per character |
|---|---|---|
| Lower-case only | 26 | 4.70 |
| Lower + capitals | 52 | 5.70 |
| Lower + capitals + numbers | 62 | 5.95 |
| Plus symbols (the default) | 71 | 6.15 |
| Default, similar characters excluded | 64 | 6.00 |
| Everything, including ambiguous characters | 89 | 6.48 |
Example: a 16-character password from the default 71-character pool has 16 × 6.15 ≈ 98.4 bits of entropy, about 4.2 × 1029 possible passwords.
To make this concrete, suppose an attacker holding a stolen database of hashes can test 100 billion guesses per second (a deliberately generous assumption for a fast hash and powerful hardware). On average they must search half the possibilities:
| Length (71-character pool) | Entropy | Average time to guess |
|---|---|---|
| 8 | 49.2 bits | about 1 hour |
| 12 | 73.8 bits | about 2,600 years |
| 16 | 98.4 bits | about 66 billion years |
| 20 | 123.0 bits | about 1.7 × 1018 years |
These figures only hold for passwords that are genuinely random. A password a person invents, such as a word with a number on the end, is far easier to guess than its length suggests, which is why a generator is worth using.
Tips for choosing and using passwords
A generator removes the guesswork about which characters to use. The rest comes down to a few decisions about length, site rules and how you keep the passwords.
Length matters most
Each added character multiplies the work of an attacker by the pool size, so length helps more than clever symbols. Twelve characters is a sensible minimum for ordinary accounts, and 16 or more is a good habit for email, banking and your password manager's master password. Current guidance from standards bodies stresses length and screening against known-leaked passwords over complicated composition rules.
When a site restricts the characters
Some sites reject symbols or cap the length. If symbols are not allowed, untick the box and add length instead. Letters and digits alone give 5.95 bits per character, so you need ceil(98.4 ÷ 5.95) = 17 characters to match the strength of a 16-character password that includes symbols. If a site refuses the ambiguous group, leave that box unticked, which is the default.
Typing a password by hand
A password that will be read aloud, printed or typed on a television or game console is easier to get right without the look-alikes. Tick Exclude similar characters and you will not have to guess whether a character is a lower-case L, a capital I or the number 1. The pool shrinks a little (64 instead of 71 for the default settings), which costs about 0.15 bits per character, so add a character or two.
Habits that protect you
- Use a different password for every account. When one site leaks its passwords, attackers try the same combination everywhere else.
- Keep the passwords in a password manager so you only need to remember one strong master password.
- Turn on two-step verification or passkeys where they exist. A stolen password is then not enough on its own.
- Do not tweak a generated password by hand, and do not store it in an email, a note without protection, or a shared document.
- Change a password when you learn it was exposed or when you suspect misuse, rather than on a fixed timetable.
Passwords you can remember
For the one or two secrets you must keep in your head, such as the master password, a passphrase of random words works better than a short jumble of symbols. Picking each word at random from a list of 7,776 gives 12.9 bits per word, so five words carry about 64.6 bits and six words about 77.5 bits. The words must be chosen by dice or a random generator, not by you; a famous quote or a lyric is not random. You can draw words from a numbered list with the random picker.
Why a strong password matters
Most break-ins do not involve anyone guessing at a login box. Attackers collect passwords from data breaches and try them on other services (credential stuffing), or they steal a file of hashed passwords and guess offline at enormous speed, where limits on login attempts do not apply. A long random password defeats the second attack by sheer arithmetic, and a unique one defeats the first.
For non-password uses, such as test data, tokens or identifiers, see the random string generator and the random alphanumeric generator. To draw a list in random order or split people into teams, try the list randomizer and the random team generator.
Generated passwords are random, but how safe they remain depends on how you store and use them. This tool is a convenience and not security advice. See the disclaimer.
Frequently asked questions
How long should a password be?
At least 12 characters for ordinary accounts and 16 or more for important ones such as email, banking and a password manager. Length adds more strength than extra symbols do.
Are the passwords really random?
Yes. Each character is drawn from the browser's cryptographically secure random generator, with a method that avoids bias toward any character. The only rule applied afterwards is that every ticked group appears at least once.
Why are lower-case letters always included?
They form the base alphabet of the generator, so there is always a usable pool even when every box is unticked. Tick the other boxes to widen it.
What are ambiguous characters?
Brackets, braces, slashes, quotation marks, the backtick, the tilde and punctuation such as commas, colons and full stops. Some websites and programs reject them or treat them specially, so they are off by default.
Is it safe to use a generated password on several sites?
No. Use a new password for every account. If one site is breached, a reused password lets attackers into all your other accounts that share it.
References
Cite this calculator and page
If you use this page in your work, you can cite it as:
Reeliy Editorial Team. (2026). Random Password Generator. Reeliy. https://reeliy.com/calculators/random-password-generator“Random Password Generator.” Reeliy, 2026, https://reeliy.com/calculators/random-password-generator.