Security · Passwords
16-character password generator.
Exactly 16 random characters: uppercase, lowercase, numbers and symbols, at least one of each. Made on your device, nothing sent or saved.
Why 16 characters
NIST SP 800-63B-4 says a password that is the only sign-in factor must be at least 15 characters long, and one used only inside multi-factor sign-in at least 8. Sixteen is the next round number above that floor, and it is short enough to type if you ever have to. With uppercase, lowercase, numbers and symbols (a 90-character set) a random 16-character password carries about 104 bits of entropy; without symbols, about 95; with symbols but without the look-alikes 0 O 1 l I, about 102. The exact figure for your settings is shown under each result.
How it works
- Browser cryptographic randomness: every character is drawn with
crypto.getRandomValues, using rejection sampling so no character is more likely than another. - One of each type: the generator draws again until each ticked type appears, so the result stays uniform over every valid 16-character password.
- Private: no network request, nothing stored. Close the tab and it is gone.
Need a different length? Use the full password generator (8 to 128 characters). Prefer words you can say aloud? Try the Diceware passphrase generator.
Sources (retrieved 2026-10)
- NIST SP 800-63B-4: 15-character minimum for single-factor passwords, 8 for multi-factor, services should accept at least 64 characters.
FAQ
Is a 16-character password strong enough?
A random 16-character password from the full 90-character set carries about 104 bits of entropy. NIST’s minimum for a password used alone is 15 characters; this clears it. Randomness matters as much as length: a 16-character phrase you chose yourself is much weaker than a random one.
Does a 16-character password need symbols?
No. NIST says services should not require particular character types, and a random 16-character letters-and-numbers password still carries about 95 bits. Untick symbols if a site rejects them.
Will every website accept 16 characters?
Most should. NIST asks services to accept at least 64 characters, but individual sites vary. If a site rejects 16, use the password generator to pick a length that fits.
Are these passwords sent or stored anywhere?
No. They are generated in your browser with the cryptographic random generator, with no network request and no storage. Copy the one you want into your password manager.
What if I want to remember it?
Use a passphrase instead: the Diceware passphrase generator makes random word-based phrases that are easier to remember and type.