How to calculate password entropy
A random password’s strength is how many passwords the generator could have made, written as a power of 2. Every extra character multiplies that number by the number of characters to pick from. Here it is for your settings:
Here it is with your numbers:
- Characters to pick from = 26 + 26 + 10 + 14
- Characters to pick from = 76
- Passwords of 16 characters = 76¹⁶
- With at least one of each (lowercase, uppercase, digits, symbols) = 1.0615 × 10³⁰
- Entropy = log₂(1.0615 × 10³⁰)
- Entropy = 99.74 bits, which rounds down to 99
It means this generator could have made 1.0615 × 10³⁰ different passwords with these settings, every one equally likely.
The count leaves out passwords missing one of the kinds you chose, because this generator never shows those (many sites demand at least one of each). Entropy is rounded down, so it never claims more strength than there is.
How long should a password be?
The National Institute of Standards and Technology (NIST) writes the rules for US government systems. Its digital identity guidelines (SP 800-63B, 2025) ask for at least 15 characters for a password used on its own, and at least 8 when it is only one part of a login that also needs a second step, such as a code. Sites should allow at least 64 characters and should not force mixes of character types; length counts for more. The Cybersecurity and Infrastructure Security Agency (CISA) suggests at least 16.
| Length | What NIST says |
|---|---|
| Under 8 | Too short for any password |
| 8 – 14 | Only with a second step to log in |
| 15 or more | Long enough on its own |
Source NIST · SP 800-63B-4, Password verifiers ↗CISA · Use Strong Passwords ↗
How this password generator works
Every character comes from your browser’s built-in cryptographically strong random number generator. To make every character exactly equally likely, it takes just enough random bits to cover the characters you chose and simply tries again when they land past the end, rather than using a remainder (which would favour some characters). Symbols are !#$%&*+-=?@^_~, which almost every site accepts.
Your password never leaves this page: it isn’t sent to us or anyone else, isn’t saved, and isn’t in the link, which only carries your settings. Reload the page and you get a new one.
Source W3C · Web Cryptography Level 2, the Crypto interface ↗
FAQs
How to create a strong password?
Make it long, random and unique: at least 16 characters, a random mix (or 4 to 7 unrelated words), and a different one for every account. A password manager can make and remember them for you.
What makes a strong password?
Length, most of all. NIST, which writes the US government’s rules, calls length a primary factor in password strength and asks for at least 15 characters for a password used on its own. Being random matters too: people’s own choices are easy to guess.
Source NIST · SP 800-63B-4, Appendix A: Strength of passwords ↗
How strong is my password?
For a random password like the ones made here, the strength is its entropy: log₂ of how many passwords could have been made. Each extra bit doubles the guesses needed. For a password you made up, entropy can’t be worked out reliably, which is why NIST judges those by length and checks them against lists of common passwords.
What is an example of a strong password?
CISA gives cXmnZK65rf*&DaaD (16 random characters) and the passphrase Horse Purple Hat Run Bay Lifting. Never use a published example as your own password: make a fresh one.
What is a password manager?
A program that makes, stores and fills in your passwords, so each account can have a long, random, unique one and you only remember one strong password: the manager’s own. Browsers have free ones built in.
Do password managers generate strong unique passwords?
Yes, most do, and NIST notes that people with password managers are more likely to choose stronger passwords, especially when the manager includes a generator. Sites should let you paste a password so the manager can fill it in.
Sources
- NIST: SP 800-63B-4, Password verifiers
- NIST: SP 800-63B-4, Appendix A: Strength of passwords
- CISA: Use Strong Passwords
- W3C: Web Cryptography Level 2, the Crypto interface