Password Generator.
A random 16-character password using upper and lower case letters, digits and symbols has about 103 bits of entropy, far beyond what can be guessed. This generator creates passwords like that in your browser with the Web Crypto API, shows their estimated strength and copies them in one click; nothing is sent or stored.
Passwords are generated on your device with crypto.getRandomValues and never leave it. Strength estimates assume a random password and an attacker making 100 billion guesses a second offline; human-chosen passwords are weaker than their length suggests.
Password Generator is a free online tool from Neweb (neweb.ai) for small businesses, with no sign-up. A random 16-character password using upper and lower case letters, digits and symbols has about 103 bits of entropy, far beyond what can be guessed. This generator creates passwords like that in your browser with the Web Crypto API, shows their estimated strength and copies them in one click; nothing is sent or stored.
| Cost | Free, no account, no watermark |
|---|---|
| Built for | small businesses, freelancers and sole proprietors |
| Made by | Neweb, the AI website builder and online presence manager (free plan; paid plans from $9/month billed yearly) |
Facts checked October 2026.
What you'll get.
A real example of what this tool produces. Run it above with your own inputs.
q7#Vt2m!Rz9@Lw4e · 16 characters · about 103 bits · Very stronghT6kWm9pXr3cVd8q · 16 characters, no symbols · about 95 bitsA strong password is long and random. Length matters most: every extra character multiplies the number of possible passwords by the size of the character pool. A random 16-character password using all four character types is far beyond the reach of brute-force guessing; an eight-character password made from a word and a year is not. This generator creates random passwords in your browser using the Web Crypto API (crypto.getRandomValues), the same source of randomness browsers use for security, rather than Math.random.
Choose a length from 8 to 64 characters, the character types a site allows, and whether to avoid look-alike characters such as O and 0 when you will type the password by hand. Each password is guaranteed to include at least one character from every type you tick, and the strength meter shows the estimated entropy in bits. The checker below lets you test an existing password locally.
The tool is free and nothing you generate or type is sent anywhere. It comes from Neweb, the AI website builder for small businesses (free plan, paid plans from $9/month billed yearly, $19 month-to-month). A unique, strong password on your website, domain, email and payment accounts is the cheapest security a small business can buy.
How to use the password generator
Set the length with the slider. Sixteen characters or more is a good default for accounts you store in a password manager.
Tick the character types the site allows, and avoid look-alikes if you will read or type the password.
Choose how many passwords to generate and click Generate passwords.
Click Copy next to the one you want and paste it straight into the sign-up form and your password manager.
Optionally type an existing password into the strength checker to see how it compares.
Why this matters for your business
Reused passwords are how small businesses get hacked. When one website leaks, attackers try the same email and password on email, banking, domain and website logins. A unique password per account stops that chain.
Your domain and website logins are critical. Whoever controls the domain registrar account controls your website and email. These accounts deserve the strongest passwords and two-factor authentication.
Random beats clever. Substitutions such as P@ssw0rd and patterns such as a word plus a year are among the first guesses attackers' tools try. Randomness is what makes a password strong.
Tips for better results
- Use a password manager so you only remember one strong master password; it can store every password this tool generates.
- Turn on two-factor authentication for email, domain registrar, website, banking and payment accounts.
- Never share passwords over email or chat; use your password manager’s sharing feature or give staff their own logins.
- Change a password immediately if a service tells you it was breached, and anywhere you reused it.
- When a site limits symbols, untick Symbols and add four or more characters of length to make up for it.
- Staff leaving? Change shared passwords and remove their accounts the same day.
Example
A real-world walkthrough
A bookkeeper in Auckland is setting up a new client portal and the client's domain registrar account. She sets the length to 20, keeps all four character types and generates three passwords. The meter shows about 129 bits, "Very strong". She copies one for the registrar, one for the portal admin, saves both in the firm's password manager and turns on two-factor authentication for each.
Out of curiosity she types the client's old password, "Kiwi2019!", into the checker, which flags it as weak because it is a word followed by a year. She changes it the same day.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated entirely in your browser with the Web Crypto API's crypto.getRandomValues, a cryptographically secure random number source, and nothing is sent to a server, logged or stored. You can disconnect from the internet after the page loads and it still works. As with any password shown on screen, copy it into your password manager and close the tab.
How long should a password be?
For accounts stored in a password manager, 16 characters or more of random characters is a sensible default, and longer costs nothing. For a password you must memorise, such as the password manager's master password, a long passphrase of several random words is easier to remember and still strong. Current guidance from bodies such as the US NIST and the UK NCSC favours length over complexity rules.
What does "bits of entropy" mean?
Entropy measures how unpredictable a password is. Each bit doubles the number of guesses needed. A random password's entropy is its length multiplied by the base-2 logarithm of the character pool: 16 characters from an 86-character pool is about 16 × 6.43 ≈ 103 bits. Around 60 bits resists online guessing; 80 bits or more is very strong for most purposes. Human-chosen passwords have far less entropy than their length suggests.
Should I avoid look-alike characters?
Only if you will read or type the password by hand, for example a Wi-Fi password printed for guests. Removing O, 0, I, l, 1 and | makes the password easier to read but slightly shrinks the character pool, so add a character or two of length to compensate. For passwords you only ever paste from a password manager, keep every character.
How often should I change my passwords?
Current guidance from NIST and the NCSC is not to force regular changes of strong, unique passwords, because forced changes push people toward weak patterns. Change a password when there is a reason: the service reports a breach, you suspect someone else knows it, you reused it elsewhere, or someone with access leaves the business.
Your entire online presence, on one subscription.
All industries and more. AI website builder, free domain, managed hosting and AI SEO, free to start and from $9/month billed yearly.