Password Generator
Your password appears above as soon as the page loads, created at random in your own browser. Choose the length and which characters it uses, copy it and you're done: it is never sent or stored anywhere.
Results are estimates. Solvemis accepts no responsibility for the results obtained or for how they are used.
Solvemis is free, with no sign-up. If it helped and you’d like to support the project: Buy me a coffee
How it works
How to use it
- Look at the password shown above: it is ready to use.
- Move the length slider between 8 and 64 characters.
- Check or uncheck lowercase, uppercase, numbers and special characters to match what the site accepts.
- Press «Copy» to put it on the clipboard or «New password» to change it.
How it is calculated
Each character is picked at random with crypto.getRandomValues, the browser's cryptographic generator, discarding the values that would make some characters more likely than others (modulo bias). The password contains at least one character from each checked group, in random positions. Strength is the entropy, length × log₂ of the number of possible characters, on our own scale: under 60 bits, weak; 60 to 100, good; 100 or more, very strong.
Entropy (bits) = length × log₂(possible characters)
Sources
- SP 800-63B-4: Authentication and Authenticator Management, 3.1.1.2 Password Verifiers — National Institute of Standards and Technology (NIST)
- Crypto: getRandomValues() method — MDN Web Docs
About this calculator
Why length counts more than symbols
With all four groups checked there are 89 possible characters, so each character adds about 6.5 bits of entropy: 16 characters give about 104 bits. Every extra bit doubles the combinations an attacker would have to try.
Dropping groups costs less than it seems if you make the password longer. With lowercase only, 16 characters give about 75 bits, but 22 already pass 100. So if a site rejects special characters, the sensible move is to uncheck them and increase the length.
A different password for every site
A long password doesn’t help much if you reuse it: when one site is breached, attackers try the same combination on other services. Use a different one for each site, keep them in a password manager and turn on two-step verification for your email and your bank.
Which special characters it uses
!#$%&*+-.:;=?@_~^()[]{}<>/|. That is 27 symbols that almost every form
accepts. Spaces and quotes are left out, because they cause trouble when you
paste the password or use it in configuration files.
Frequently asked questions
Is it safe to generate a password on a website?
Here it is: the password is created in your browser with its cryptographic generator (crypto.getRandomValues) and never travels to any server. Solvemis never sees or stores it. You can check: once the page has loaded, disconnect from the internet and «New password» keeps working.
How long should a password be?
At least 15 characters if it is the only thing protecting the account, according to NIST's digital identity guidelines, and at least 8 if you also use a second factor. That is why the tool suggests 16.
Do I need to mix uppercase, numbers and symbols?
It helps, but length matters more: every extra character multiplies the combinations, and NIST tells services not to require mixing character types. If a site doesn't accept special characters, uncheck that box and increase the length.
Updated 1 October 2026
Missing something in this tool, or a tool we don't have? Write to us