Random Password Generator

1. How to generate a random password
• Secure generation process
2. Tips for creating strong passwords
• Password length
• Symbols used
• Other tips
• Strong passwords you can remember
3. Why you need a strong password

    How to generate a random password

This free password generator can create a very strong random password. It uses strong cryptographic algorithms to generate random numbers which are then matched to symbols based on your preferences such as password length and what types of characters to include. The result is a randomly generated password.

Some websites and other software only allow certain symbols in passwords. In an increasing trend for higher security many websites and apps have started requiring the presence of symbols of a particular type to ensure a minimum password strength. To generate a password that meets such requirements use the controls to include (or not include) numbers (0..9), capital letters ( A..Z ), symbols ( !@#$%&*?^ ), and potentially ambiguous characters ( ({}[]()/'"`~,;:.<>)\ ). Small letters ( a..z ) are included by default.

Secure generation process

The password generated in this tool is only visible to you and a new one will be created each time you press the button and the page reloads. Our server does not store any of the random passwords it generates for you so once you close this page only you will know that it ever existed!

To prevent anyone from potentially sniffing your network traffic and learning your newly created password, this random password generator uses a secure transfer protocol - HTTPS, or more precisely encryption & authentication with TLS 1.2 (a strong protocol), ECDHE_RSA with P-256 (a strong key exchange), and AES_128_GCM (a strong cipher). You can verify that in your browser, like so:

    Tips for creating strong passwords

By using this generator of strong passwords you are already on the right track to getting yourself a secure password. Here we offer additional tips that will help.

Password length

Password length is the most important factor for a strong password, which is due to how combinatorics work. Using our permutations calculator you can see that a randomly generated password with 4 symbols using only small letters can be one of 456,976 possible permutations. This will take less than a second to guess by brute force (trying every possible combination). Adding just one more symbol, the possible permutations are now 11,881,376 - much, much better, though still not great. Now add 5 more symbols, so your password becomes 10 characters long. The possible combinations with just small letters for such a password are the impressive 95,428,956,661,682,176. Even computers take time when they need to perform so many calculations.

Therefore, the simplest way to improve the security of your account is to add one (or several) more characters to your password. 16 characters is a good length, though passwords with lengths between 12 characters and 16 characters should be sufficient in most cases. Our generator supports very long passwords such as 128 characters long ones.

Symbols used

Let's return to our 4-letter password example that had under 500,000 possible variants and add capital letters and numbers into the mix. This makes the total unique symbols in it 62 (26 x 2 + 10). With 62 distinct symbols, the possible permutations are 14,776,336 or 32 times better than with just small letters. So, expanding the characters set results in an exponential increase in how hard it is to guess the password by brute force. It also makes it less likely for dictionary attacks to succeed. This password generator supports all latin letters (lower and upper case), all numbers, as well as 29 special characters.

Other tips

If you decide to forgo random password generation and want to come up with the password yourself, here are some things to avoid:

• character repetition
• keyboard patterns
• dictionary words
• letter of number sequences like "1234" and "bcdef"
• names of relatives, pets, romantic partners

Things like dates of birth, anniversaries, and phone numbers are a no-go as well. These are all to prevent guessing the password through social cues and other available information such as social media profiles. Any information that might be known to colleagues or acquaintances should be avoided, as well as information that might become public at some point in the future.

Strong passwords you can remember

Some recommend stringing together words from a phrase, like brownthreesarethecoolest and then intermixing them and switching up numbers for some of the letters, e.g. br0wn^threes.are^the.c00lest!. This password is 30 characters long so if it were randomly generated it would be absolutely unassailable, but a clever dictionary attack can vastly reduce the time it takes to break it. It is therefore not supported in this strong password generator, but you can use this approach at your own (unknown) risk.

    Why you need a strong password

There are two scenarios in which having a strong password helps. In the first one, a malicious entity ("attacker") may want to try to gain access to your mobile phone, laptop or PC, online banking, e-mail, online storage, social media accounts, etc. by trying to guess your password. Usually this is done with automated tools that try to log in many times per minute or per second. Both laptops and PCs, and a lot of websites have measures in place designed to slow down such attempts, but they are still viable in many cases. The stronger the password you produce using the random password generator, the more attempts will be needed to guess it (on average, one might just be extremely lucky and guess it from the first try!) thus the more time it will be required. A strong enough password should make it so that the average time to break it would be measured in years of dedicated computing power.

The second scenario is when a data breach happens. That is, when a company's security is overcome and as a result an attacker now has your password hash, alongside those of other victims. Securely built modern websites do not store passwords in plain text. Instead, they are stored as hashes produced by cryptographic algorithms such as MD5 (old), SHA1, SHA256, SHA512 and so on. These are one-way algorithms, meaning that the website can use the hash to check if you have entered your password correctly without actually storing it.

In this scenario the hacker now has your password hash and the only limit on how fast he tries to guess it is the number of tries he can do per second. A fast machine and a fast GPU can do billions of attempts per second and these can further be improved by dictionary attacks. Having a random password of sufficient length can make such brute force attempts take way too long.

Another thing criminals do is what is known as a dictionary attack. It involves password guessing using words from a dictionary, say the English language dictionary, instead of trying randomly generated strings. A dictionary can comprise of passwords learned from previous breaches, or of specially crafted strings using a rule that is supposed to improve the guessing speed. The best way to protect against dictionary attacks is to not use meaningful words, so a random password generator like ours is great against them.

Password length and randomness are key

In all cases, the rate at which an attacker can make login attempts to the system combined with the number of possible passwords determines the likelihood of success. While you don't usually have control over the attempt rate, you do have complete control over the strength of your password so increasing it decreases the odds that you become a victim of stolen identity. A random password thwarts dictionary attacks while a password many characters long hinders brute force attempts.