Password Generator and Strength Calculator
Generate a password from a seed you choose, with the exact entropy of the scheme, the search space it implies, and an honest verdict on how strong it really is.
Password Generator and Strength Calculator: with the default inputs, generated password is H=bf/[e^U6H4@JdH1=C/.
Length buys more strength than complexity does. 16 or more is a good default.
26 punctuation characters, chosen to avoid quotes, backslash, backtick, space and pipe.
Change this for a different password. The same seed and settings always give the same result — which is the point, and also the limitation.
- Entropy
- 129.05Bits. Each extra bit doubles an attacker's work.
- Characters to choose from
- 88
- Possible passwords
- 7.041 × 10^38
- Average time to guess
- 111558973752488260000 years, 0 secondsAt 10¹¹ guesses per second — a GPU rig against a fast hash.
- Verdict
- Far beyond brute force — every extra bit here is symbolic rather than useful.
Assumptions
- The password is generated from an explicit seed, not a cryptographic random source, so it is reproducible by anyone who knows the seed.
- Entropy is the exact log₂ of the number of passwords this scheme can produce, given that one character of each selected type is required.
- Crack times assume 10¹¹ guesses per second against a fast hash; a slow hash such as Argon2 or bcrypt is many orders of magnitude harder.
| Length | Entropy (bits) | Average time to guess |
|---|---|---|
| 8 | 51.7 | 0.2 days |
| 12 | 77.5 | 34,168 years |
| 16 | 103.4 | 2,049,065,136,757 years |
| 20 | 129.2 | 122,881,485,485,092,210,000 years |
| 24 | 155 | 7,369,145,667,531,698,000,000,000,000 years |
| 32 | 206.7 | 26,501,992,003,654,774,000,000,000,000,000,000,000,000,000 years |
Each extra character multiplies the work by 88. Each extra bit doubles it. That is why 20 random characters beat any amount of clever substitution in a dictionary word.
How this is worked out
The formula
Entropy of a uniformly random password: bits = log₂(number of possible passwords) With N characters in the pool and length L, and a rule that every selected class must appear at least once, inclusion–exclusion over the k classes gives the exact count: possible = Σ over subsets S of the classes (−1)^|S| × (N − size of S)^L bits = log₂(possible) Average guesses to find it = 2^(bits − 1) Average time = 2^(bits − 1) ÷ guesses per second This is the entropy of the *scheme*. It is only the attacker's real workload if the password was drawn uniformly from that scheme and the attacker knows nothing else.
Open How it’s calculated above to see this worked through with your own numbers.
What you enter
- Length
- Length buys more strength than complexity does. 16 or more is a good default.from 4 to 128 · whole numbers only · defaults to 20
- Lower-case letters (a–z)
- Turn this on or off.defaults to on
- Upper-case letters (A–Z)
- Turn this on or off.defaults to on
- Digits (0–9)
- Turn this on or off.defaults to on
- Symbols (!@#$…)
- 26 punctuation characters, chosen to avoid quotes, backslash, backtick, space and pipe.defaults to on
- Leave out look-alike characters(under More options)
- Removes I, l, 1, O, 0 and o. Easier to read aloud, slightly weaker.defaults to off
- Seed
- Change this for a different password. The same seed and settings always give the same result — which is the point, and also the limitation.up to 64 characters · defaults to "kitchen-table-2026"
What you get back
- Generated passwordmain answer
- Entropy
- Bits. Each extra bit doubles an attacker's work.
- Characters to choose from
- Possible passwords
- Average time to guess
- At 10¹¹ guesses per second — a GPU rig against a fast hash.
- Verdict
What this assumes
- The password is generated from an explicit seed, not a cryptographic random source, so it is reproducible by anyone who knows the seed.
- Entropy is the exact log₂ of the number of passwords this scheme can produce, given that one character of each selected type is required.
- Crack times assume 10¹¹ guesses per second against a fast hash; a slow hash such as Argon2 or bcrypt is many orders of magnitude harder.
About this calculator
Set a length, choose which character types to include, type any seed you like, and get a password back — along with a genuinely exact measure of how much unpredictability the scheme contains.
Read this before you use it for anything real
This generator is seeded, and that is deliberate. Every calculator on this site is a pure function of its inputs: the same inputs always produce the same outputs, on the server and in your browser, so results can be linked, shared and tested. A generator that reached for the operating system's cryptographic random source would break that, and would also quietly change its answer every time the page re-rendered.
The consequence is that the seed is the secret. Anyone who knows your seed and these settings gets your password back exactly. The 100-plus bits of entropy reported below describe the space of passwords this scheme can produce — not the difficulty of guessing yours, if your seed is your dog's name.
So: this is a convenience tool. Use it for a wifi guest network, a throwaway account, a demo login, a password you need to read down the phone. For anything of value, use a real password manager — 1Password, Bitwarden, KeePass, or the one built into your browser or operating system. They generate from a cryptographic random source, they store the result so you never have to retype it, and they remove the only genuinely dangerous habit in password security, which is reuse.
What the entropy number actually means
Entropy in bits is log₂ of the number of passwords the scheme could produce. 20 characters drawn from a pool of 88 gives about 129 bits, meaning roughly 2¹²⁹ possibilities. Each additional bit doubles an attacker's work; each additional character multiplies it by the pool size.
The figure here is exact rather than the usual approximation. Most calculators quote log₂(N^L), which ignores the near-universal rule that the password must contain at least one of each selected type. That rule shrinks the space slightly, and the calculator computes the true size by inclusion–exclusion over the character classes — then generates by rejection sampling from exactly that set, so the number describes the generator that produced your password rather than a different, hypothetical one.
Length beats complexity
If you take one thing away: add characters, not character types. Going from 12 to 16 characters over a 62-character pool adds about 24 bits. Adding symbols to a 12-character password adds about 6. Length is the cheap axis, and it is the one that keeps working.
This is also why passphrases work. Five words drawn at random from a 7,776-word list carry about 64 bits and are far easier to remember than 11 random characters carrying the same. What does not work is a memorable word with predictable substitutions: P@ssw0rd! contains almost no entropy at all, because every cracking tool applies those substitutions automatically.
About the crack-time estimate
Times assume 10¹¹ guesses per second, which is a realistic GPU rig attacking a fast hash such as MD5, SHA-1 or NTLM. Against a properly slow hash — bcrypt, scrypt, Argon2 — an attacker manages thousands per second rather than billions, and even a modest password holds up. Against a site that leaked plaintext, no password strength helps at all. The number is a floor on your safety, not a promise.
Frequently asked questions
▸Is a seeded password generator safe?
Only as safe as the seed. Anyone with the seed and the same settings reproduces the password exactly. Use this for convenience passwords and a password manager, which draws from a cryptographic random source, for anything valuable.
▸How long should a password be?
Sixteen characters or more from a mixed pool puts you past 100 bits, which no brute-force attack reaches. Length matters far more than character variety: adding four characters beats adding symbols several times over.
▸How is the entropy calculated?
log₂ of the exact number of passwords the generator can produce. Because at least one character of each selected type is required, the count is done by inclusion–exclusion rather than the usual N^L approximation.
▸Are passphrases better than random passwords?
They are easier to remember at the same strength. Five words chosen at random from a 7,776-word list carry about 64 bits. What matters is that the words are chosen randomly — a memorable sentence you wrote yourself carries far less.
▸Why does the crack time vary so much between sites?
Because it depends on how the site stores your password. A fast hash lets an attacker try 10¹¹ candidates a second; bcrypt or Argon2 cuts that to thousands. You cannot control which one a site uses, which is the strongest argument for never reusing a password.
Put this calculator on your own site
A working password generator, free for any site, with no ads and no sign-up. It resizes to fit wherever you paste it and updates itself as this page improves.
Paste this anywhere. It works on any site, carries no ads, never expires, and always shows the current version.
Password Generator and Strength Calculator by CalculateItNow
The page's own title. The clearest description of what the link leads to.
The credit line sits outside the widget on purpose, so it is a real link on your page rather than one buried in a frame. Please keep it — it is what pays for CalculateItNow staying free and ad-free. The script only resizes the widget to fit its contents; drop it and the widget still works.
Browse every calculator widget·How to add it to WordPress, Squarespace or Wix
Related calculators
The questions people ask next to a password generator.
Password entropy in bits from length and character set, with the size of the search space and the time to crack at a guess rate you set.
nCr and nPr, with or without repetition — exact answers for huge counts, the formula substituted, and a plain explanation of when order matters.
Add, subtract, multiply, divide, take remainders and raise to powers with integers of hundreds of digits — exactly, well past what a normal calculator holds.
Draw whole numbers from any range, with or without repeats, from an explicit seed — so the same seed always reproduces the same draw and anyone can check it.
Raise any base to any power — negative, fractional or huge — with the expanded multiplication, scientific notation and the rule that applies shown.
Logarithm of any number to base 10, e, 2 or any base you choose — with the change-of-base step, an antilog check, and ln, log₁₀ and log₂ side by side.