What “random” really means for a password
Humans are terrible at being random. Asked to “make up something random”, people favour certain letters, put capitals at the start, numbers at the end and a ! after that. Cracking tools know these habits and test them first. A random password generator removes the human from the process: every position is chosen independently, and every allowed character is equally likely.
That second property is easy to get wrong. Many simple scripts take a random 32-bit number and use % charset.length. Because 4,294,967,296 is not evenly divisible by, say, 94, the first characters of the set come up slightly more often. This tool uses rejection sampling — it discards the few random values that would cause bias — so the distribution is perfectly uniform.
Where the randomness comes from
The generator calls crypto.getRandomValues(), which is fed by your operating system’s cryptographic random source (the same one used to create TLS keys for HTTPS). It is designed so that past outputs reveal nothing about future ones. Math.random(), by contrast, is a fast statistical generator that is not meant for secrets — its internal state can be reconstructed from a handful of outputs.
How many random passwords are possible?
| Character set | Size | 12 characters | 16 characters |
|---|---|---|---|
| Digits only | 10 | 40 bits | 53 bits |
| Lowercase letters | 26 | 56 bits | 75 bits |
| Letters + digits | 62 | 71 bits | 95 bits |
| All printable ASCII | 94 | 79 bits | 105 bits |
Each bit doubles the number of guesses needed. Around 80 bits is out of reach for any realistic brute-force attack today; this tool shows the exact figure for your settings in the strength meter.
Random password vs. random passphrase
A random character string packs the most strength into the fewest characters, which makes it ideal for anything stored in a password manager. If you have to remember the secret — your computer login or the manager’s master password — a random passphrase made of whole words gives the same security with far less effort. Both are random; they just use different “alphabets”.
Good habits with random passwords
- Generate a new one for every account — never reuse.
- Let a password manager or your browser’s built-in manager remember them.
- Turn on two-factor authentication wherever it is offered; see our TOTP tool to understand how those 6-digit codes work.
Last updated: · Reviewed by the Password Generator team