# Password Generator URL: https://discuvr.org/password-generator/ Last updated: 2026-11-08 MCP tool: `generate_password` Generate a strong, random password with cryptographically secure randomness. Choose length and character types and see its strength in bits of entropy. A strong password is one an attacker cannot guess or predict, which means it has to come from a source that cannot be predicted either. This generates one using Python's cryptographic random number generator, not the faster but predictable kind built into most programming languages, and shows you exactly how much guessing work it represents. ## What it does - Uses Python's cryptographically secure random source for every character and for shuffling - never the predictable kind of random number generator. - Choose length from 4 to 128 characters, and any combination of uppercase, lowercase, digits and symbols. - Guarantees at least one character from every type you select, so a password never silently drops a type you asked for. - Reports the entropy in bits (length times log2 of the pool size) and a plain-language strength band, both from a fixed formula, not a guess. - Generated fresh on each request and handed straight back - never written to disk, a database, a cache or a log. ## How it works 1. Set a length and choose which character types to include. 2. Press Generate. 3. Copy the password - generate again for a different one any time. ## Why not an ordinary random number generator Python's everyday random module is a Mersenne Twister - fast, and excellent for simulations, but its entire internal state can be reconstructed from 624 consecutive 32-bit outputs, after which every number it will produce next becomes predictable. This tool instead draws from the operating system's own cryptographic random source, through Python's secrets module, which Python's documentation recommends for passwords and security tokens. Every random decision here, including the step that shuffles the assembled characters, uses it. ## What the entropy number means Entropy in bits is the length of the password times the base-2 logarithm of how many distinct characters could have appeared at each position - for example, a 16-character password drawn from all four character types (26 uppercase, 26 lowercase, 10 digits and 26 symbols, 88 characters) has about 103 bits of entropy. Each extra bit doubles the number of passwords an attacker would have to try, and each extra character from that pool adds about 6.5 bits, so adding four characters multiplies the guessing work by roughly 60 million. The strength band shown alongside it (weak, fair, strong, very strong) comes from fixed bit-count thresholds, not a judgment call. ## How long should a password be? What NIST says NIST SP 800-63B-4 (2025), section 3.1.1.2, requires a password used on its own to sign in to be at least 15 characters long, and at least 8 when it is only one part of multi-factor sign-in. It also says sites must accept passwords of at least 64 characters and must not force a mix of character types or periodic changes. Length is what buys strength: 20 lowercase letters give 94 bits, more than 12 characters from all four types (77.5 bits). If a site caps the length or rejects symbols, use the longest length it accepts and untick Symbols. ## Which symbols are used, and characters that look alike The Symbols option draws from 26 characters: ! @ # $ & * ( ) - _ = + [ ] { } ; : , . < > ? / ~ ^. It leaves out the space, backslash, quotation marks, backtick, % and | because some older systems reject or mangle them. Look-alike characters such as 0 and O, or l, 1 and I, are not removed, so copy and paste the password rather than retyping it. The bits shown assume the password stays secret and unique: one reused on several sites or kept in a shared file is weaker than the number says. ## Questions **Is the password I generate ever stored or logged?** No. It is generated and returned in the same request, and never written to disk, a database, a cache or a log. **Why did my password not include every character type I selected?** It always does, as long as the length you chose is at least the number of types you selected - one character from every selected type is guaranteed, not left to chance. **What does the strength band mean?** It reflects the entropy in bits: under 40 is weak, 40-59 is fair, 60-79 is strong, and 80 or more is very strong. These thresholds are fixed, not a model judgment call. **Why use this instead of a phrase I make up myself?** A password you make up draws on patterns in your own memory and habits, which is exactly what makes it guessable. A password from a cryptographic random source has no pattern to guess. **How many characters do I need for a Strong or Very strong rating?** It depends on which character types you tick, because each one adds to the pool. With all four types (88 characters, about 6.46 bits each), 10 characters reach Strong and 13 reach Very strong. With letters and digits but no symbols (62 characters), it takes 11 and 14; lowercase only (26), 13 and 18; digits only (10), 19 and 25. The default, 16 characters with all four types, gives about 103.4 bits. An 8-character password with every type is only about 51.7 bits, which is Fair. **Can it generate a random PIN or numeric code?** Yes. Untick everything except Digits (0-9) and set the length, from 4 up. Every digit is equally likely at every position, leading zeros included, so 0472 or even 1111 can come up; if a bank or door system rejects repeated or sequential digits, press Generate again. Expect the strength to read Weak: a 4-digit PIN is about 13.3 bits (10,000 possible codes) and a 6-digit one about 19.9 bits (1,000,000). That is normal for a PIN, which is only safe where the card, phone or lock blocks further tries after a few wrong guesses. For anything that could be guessed offline, use a full password instead. **Will the password meet my company policy or work as a Wi-Fi password?** For the usual work rule, yes. A policy such as "at least 12 characters with an uppercase letter, a lowercase letter, a number and a symbol" is met every time when you tick all four types and set the length to 12 or more, because one character of every ticked type is guaranteed. The tool cannot follow a list of allowed symbols, a ban on repeated or sequential characters, or a rule against your name, so if a system rejects the result, press Generate again. If it refuses symbols, untick Symbols and add 2 characters: 14 letters and digits give 83.4 bits, more than 12 characters of all four types (77.5 bits). A WPA2-Personal Wi-Fi passphrase must be 8 to 63 printable ASCII characters (IEEE 802.11i-2004, Annex H.4.1; Microsoft MS-TCC section 2.2.2.9). Everything this tool produces is printable ASCII, so any length from 8 to 63 works; 20 letters and digits (about 119.1 bits) are easy to type on a TV or printer. **Should passwords be changed every 90 days?** No, not on a fixed schedule. NIST SP 800-63B-4 (2025), section 3.1.1.2, says verifiers shall not require users to change passwords periodically, but shall force a change when there is evidence of compromise. Forced changes tend to produce predictable edits, such as Winter2026! becoming Spring2026!. Change a password at once after a breach notice, a phishing click or if it was shared, then generate a new one here and keep it in a password manager instead of reusing it on another site. ## More in Everyday Helpers - [Word Counter & Readability Analyzer](https://discuvr.org/word-counter/) - [Age / Date Difference Calculator](https://discuvr.org/age-calculator/) - [Date Difference Calculator](https://discuvr.org/date-difference/) - [Percentage Calculator](https://discuvr.org/percentage-calculator/) ## Often used with - [Website Security Scan](https://discuvr.org/security-scan/) - [Encode / Decode](https://discuvr.org/encode-decode/) --- Part of Discuvr (https://discuvr.org/): Discuvr is a collection of free, focused tools for day-to-day professional work - office and data utilities, legal and compliance helpers, privacy and security checks, and developer formatters. Every tool has its own page, and most can also be called from ChatGPT or Claude over MCP.