Password Generator
A password generator produces a random string from a chosen character set using a cryptographically secure random source, so the result carries no pattern an attacker can predict. NIST SP 800-63B-4 requires at least 15 characters where a password is the only authentication factor, and at least 8 when it is paired with a second factor. CISA recommends 16 or more.
Characters to exclude from the password (useful for avoiding ambiguous characters)
Cryptographically Secure
Uses crypto/rand for true randomness, not predictable pseudo-random generators.
High Entropy
Longer passwords with mixed character types provide exponentially more security.
Best Practices
Use unique passwords for each account and store them in a password manager.
Command Line
How long should a password be in 2026?
NIST SP 800-63B-4 puts the floor at 15 characters where a password is the only authentication factor, and at 8 where a second factor is present. CISA recommends 16 or more. The same standard requires systems to accept passwords of at least 64 characters and to permit every printable ASCII character plus spaces and Unicode. It also explicitly discourages composition rules (the “must contain one uppercase, one digit and one symbol” pattern) and mandatory periodic rotation, on the evidence that both push users toward predictable variations rather than genuine randomness. Length and randomness are what matter.
What is password entropy, and how many bits do I need?
Password entropy is the size of the search space an attacker must cover, expressed in bits. A password of L characters drawn uniformly from an alphabet of N symbols carries L × log₂(N) bits. Each extra bit doubles the work. That figure only means something if the password really was generated at random. A human-chosen password of the same length and character set carries far less, because the choice is not uniform.
| Length | Lowercase + digits (36) | Mixed case + digits (62) | All printable ASCII (94) |
|---|---|---|---|
| 8 characters | 41.4 bits | 47.6 bits | 52.4 bits |
| 12 characters | 62.0 bits | 71.5 bits | 78.7 bits |
| 16 characters | 82.7 bits | 95.3 bits | 104.9 bits |
| 20 characters | 103.4 bits | 119.1 bits | 131.1 bits |
| 32 characters | 165.4 bits | 190.5 bits | 209.7 bits |
For an attacker model of 10¹² guesses per second against a fast unsalted hash such as SHA-256 on GPUs, exhausting a 52-bit space takes about 1.6 hours and a 64-bit space about seven months. 80 bits takes roughly 38,000 years at that rate, which is why 80 bits is the usual threshold for “beyond practical offline cracking”. A 16-character password over the full ASCII set is 105 bits and has an enormous margin over that line. Note that these numbers assume the attacker has the hash: against an online login with rate limiting, far less entropy suffices.
Where is this password generated?
On the DNSX server. The generator uses Go's crypto/rand, which reads from the operating system CSPRNG, and returns the result over TLS. The generated password is not written to disk, not logged, and not retained after the response is sent.
This is stated plainly rather than implied, because most competing generators claim the password never leaves the browser. If that property matters for your threat model, say because you do not want to trust the transport or the operator at all, generate the password in your own shell instead: openssl rand -base64 24 or, on Linux, head -c 32 /dev/urandom | base64.
Why is a random password stronger than a memorable one?
No Patterns
Randomly generated passwords contain no dictionary words, keyboard patterns, or personal information that attackers can guess.
Maximum Entropy
Each character is independently selected from the full character set, ensuring the highest possible entropy per character.
Breach Resistant
Random passwords do not appear in leaked password databases. Attackers cannot use common password lists to crack them.
Password Manager Friendly
Generated passwords are meant to live in a password manager, so you never have to memorise one. Entropy is the only thing you are optimising for.