Password Generator Calculator

Related Calculators

Random password: A secret made from random characters such as letters, numbers, and symbols.

Passphrase: A secret made from random words. It is often longer and easier to type than a random character password [2][3].

Password length (characters): How many total characters are in the password.

Passphrase length (words): How many random words are in the passphrase.

Symbol set: The list of symbols the generator is allowed to use.

Possible combinations: The total number of different results your current settings can make.

Estimated strength (bits): A compact way to describe size of the search space. More bits means more possible passwords there are.

Estimated search space: A rough guess-count scale based on the total combinations, shown here as the midpoint of all possibilities.

Site compatibility note: A short warning when spaces or some symbols may not work on every website.

Mistake: Setting What do you want to make? to Random password but changing Passphrase length (words) and expecting the result to use words.
Fix: In password mode, use Password length (characters) . Switch to Passphrase if you want random words.

Mistake: Turning off Include lowercase letters , Include uppercase letters , Include numbers , and Include symbols at the same time.
Fix: Turn on at least one character type so the calculator can create a Generated password or passphrase .

Mistake: Leaving Force at least one of each selected type on while using a very short Password length (characters) .
Fix: Make Password length (characters) at least as large as the number of enabled groups, or turn off Force at least one of each selected type .

Mistake: Choosing Passphrase separator = space, then using the result on a site that does not allow spaces.
Fix: Read the Site compatibility note . If needed, switch Passphrase separator to hyphen, dot, or no separator and generate again.

Mistake: Picking the larger Symbol set and assuming every website accepts every symbol.
Fix: Check the Site compatibility note . If a site rejects the password, use Symbol set = common or turn off Include symbols .

Mistake: Looking only at Strength level and ignoring Estimated strength (bits) and Possible combinations .
Fix: Use all three together. A longer result usually raises Estimated strength (bits) and Estimated search space much faster than small style changes.

• This tool estimates strength from your selected settings, not from whether a real attacker knows extra information about you.
• Unconstrained random passwords and passphrases use uniform random selections from the actual available characters or words. The type-constrained password mode is separately labeled because its distribution differs.
• Passphrases use the 94 unique words built into this page. Strength is calculated from that actual list, not from a larger external word list. Choose more words if the displayed strength is too low.
• Strength level is a simple rating for comparison, not a universal security guarantee.
• Some websites reject spaces, long passwords, repeated characters, or certain symbols. That is why the calculator shows a Site compatibility note instead of promising every site will accept the result.
• With "Force at least one of each selected type" enabled, generation is constrained and is not uniform over all pool-size-to-length combinations. The displayed bits and combinations are therefore labeled as upper bounds, and no strength rating is assigned. The midpoint is for the unrestricted space, not an expected attack count for the constrained generator.
• This page shows search space and midpoint guesses, not real crack time, because crack time depends on the attack method and speed assumptions.

How the calculator estimates strength

In random password mode, the calculator first counts how many characters are available from your selected groups.

R = Lc + Uc + D + Sc

R is the usable character pool size, Lc is lowercase letters, Uc is uppercase letters, D is digits, and Sc is symbols. If Avoid similar-looking characters is on, removed characters are subtracted before the total is used.

Then it estimates the number of possible passwords from pool size and length.

N = R^L

N is the number of possible passwords and L is Password length (characters).

In passphrase mode, the calculator uses the word-list size and word count.

N = W^K * C * A

W is the actual unique built-in word-list size: 94. K is "Passphrase length (words)". "Capitalize each word" and "Passphrase separator" are fixed style choices and add no randomness, so C = 1. "Add a number to the passphrase" appends one random digit, so A = 10 when selected and A = 1 otherwise. Four words plus one digit give 94^4 * 10 = 780,748,960 combinations, about 29.5 bits.

Next, the calculator converts the total combinations into bits.

H = log2(N)

H is Estimated strength (bits). This is another way to describe how many possible passwords there are. Higher is better.

It also shows a simple midpoint guess estimate.

G = N / 2

G is Estimated search space. It is a scale guide, not a promise about real attack time.

Mini example

Suppose you use a 16-character random password with lowercase, uppercase, numbers, and the common symbol set, with "Avoid similar-looking characters" and "Force at least one of each selected type" off. The pool is 26 + 26 + 10 + 14 = 76 characters.

N = 76^16

H = log2(76^16) = 99.97 bits (about 100.0 bits)

G = 76^16 / 2

That huge jump shows why increasing length usually helps more than forcing one extra symbol.

How the notes are decided

The Site compatibility note is based on your choices. For example, a passphrase with spaces may fail on some websites, and a larger Symbol set may include characters that some sign-up forms reject. Random password generators and passphrase generators are both common patterns in password tools [1][2][3].

Assumptions used

The estimates assume the generated result is truly random, hidden inputs are ignored in the inactive mode, and the selected symbol set stays fixed so the displayed math matches the actual generator output.