Random passwords with custom character sets.
H = L × log₂(N)
The security of a generated password is measured by its entropy in bits. Entropy quantifies how unpredictable the password is: higher entropy means more guesses are needed to crack it by brute force.
Entropy is calculated as:
H = L × log₂(N)
where H is entropy in bits, L is the password length (number of characters), and N is the size of the character pool (alphabet). Each additional character or larger alphabet multiplies the number of possible passwords, increasing security exponentially.
H = L × log₂(N) H = 16 × log₂(94) log₂(94) = ln(94) / ln(2) = 4.5433 / 0.6931 ≈ 6.5546 H = 16 × 6.5546 ≈ 104.87 bits
Result: H ≈ 104.9 bits of entropy
A 16-character password drawn from 94 printable ASCII characters yields approximately 104.9 bits of entropy. This means there are 94¹⁶ ≈ 3.72 × 10³¹ possible passwords — far beyond the reach of any modern brute-force attack. Even at one trillion (10¹²) guesses per second, exhausting the search space would take roughly 1.18 × 10¹² years — many times longer than the age of the universe. This password is considered extremely strong for any use case.
A strong password has two key properties: length and randomness. Length increases the number of possible combinations exponentially, while true randomness (no dictionary words, no patterns) ensures an attacker cannot shortcut the search.
| Character Set | N (Alphabet Size) | |---|---| | Lowercase only (a–z) | 26 | | Upper + Lowercase | 52 | | Alphanumeric (A–Z, a–z, 0–9) | 62 | | All printable ASCII (+ symbols) | 95 |
Humans are notoriously bad at choosing random passwords. We gravitate toward words, names, and predictable substitutions (e.g., '@' for 'a'). A computer-generated random password — like those produced by this tool — samples each character independently and uniformly, guaranteeing the full theoretical entropy.
The best practice is to generate a unique, high-entropy password for every account and store them in a reputable password manager (e.g., Bitwarden, 1Password, KeePass). You only need to remember one strong master password.
The generator uses a cryptographically secure pseudo-random number generator (CSPRNG) — not the weaker Math.random() often found in web apps — to pick each character from your selected alphabet. This ensures the output is suitable for real-world security use.
A passphrase is a sequence of random words (e.g., 'correct-horse-battery-staple') that is long and memorable. A random character password maximizes entropy per character but is harder to memorize. Both can be equally strong; passphrases of 5–6 random words achieve 65–78 bits of entropy using the Diceware method.
Modern guidance (NIST SP 800-63B) recommends against mandatory periodic password changes unless there is evidence of compromise. Instead, use a unique strong password per site and change it only if a breach is suspected or confirmed.
A Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) produces output that is statistically indistinguishable from true randomness and cannot be predicted even if previous outputs are known. Using a CSPRNG (like the browser's Web Crypto API) ensures your generated password has the full theoretical entropy — unlike weaker generators that could introduce patterns.
With N = 62 (26 upper + 26 lower + 10 digits) and L = 12, the total is 62¹² ≈ 3.23 × 10²¹ possible passwords. That corresponds to H = 12 × log₂(62) ≈ 71.5 bits of entropy — borderline strong.
For most online accounts, 16 characters is a good minimum. For high-value accounts (email, banking, password manager master password), use 20–32 characters. NIST guidelines (SP 800-63B) emphasize length over complexity rules.
Yes, provided the generator uses the Web Crypto API (window.crypto.getRandomValues), which is a cryptographically secure source of randomness. GodCalculator's generator never sends your password to a server — all generation happens locally in your browser.
72 bits or more is considered strong for standard accounts. For critical credentials like master passwords or encryption keys, aim for 100+ bits. Our worked example shows that a 16-character, full-character-set password achieves ~104.9 bits.
Yes, whenever the site or app permits it. Including symbols expands the alphabet from 62 (alphanumeric) to ~94 characters, adding roughly 6–10 bits of entropy depending on length — equivalent to adding 1–2 extra characters.
Absolutely. Adjust the character set to match the requirement — for a numeric PIN select digits only, for an API key use alphanumeric or full ASCII, and for a WPA2 passphrase use any mix of characters up to 63 characters long.
Only sources that have been reviewed are shown. Unverified citations are never published.
Spotted an inaccuracy or have an idea to improve this calculator? Let us know.
We use cookies to operate the site, and — with your consent — to show advertising and measure usage. You can change your choice anytime in Cookie Settings.