16 Character Password Generator
Generate a 16-character password — the length security guidance converges on for important accounts. Random, cryptographic and created in your browser; just set the length to 16 above.
Why the whole internet settled on sixteen
Ask security guidance how long a password should be and the answers cluster: at least 12, ideally 16 or more. Sixteen is the sweet spot where a random password stops being a realistic brute-force target while remaining acceptable to essentially every sign-up form ever built. This page pre-aims the password generator at that length: set 16, generate, done — a password with roughly a hundred bits of entropy, which no plausible attacker grinds through.
The maths, briefly
Each character chosen from a 94-symbol alphabet carries about 6.55 bits of entropy. Sixteen of them multiply out to ~104 bits — 2 × 10³¹ possibilities. Offline cracking rigs that test trillions of guesses per second still face billions of years of expected work. Compare a typical human password — a word, a capital, a year, an exclamation mark — which cracking dictionaries dismantle in minutes. Length plus randomness is the entire trick, and 16 random characters deliver both.
Using it well
Generate one per account, save it in a password manager, and never type it anywhere except the real site's login. If a service caps you below 16, take its maximum and turn on all character classes. For the reasoning behind secure generation itself, see the secure password generator; for maximum-strength settings, the strong password generator.
Private by design
The password is created in your browser with cryptographic randomness and is never sent to or stored on any server. Copy it before you close the tab — after that, it is unrecoverable by design.
Frequently asked questions
Why 16 characters specifically?
Sixteen is where practical security lands: long enough that brute-forcing a random password is far beyond realistic budgets, short enough that every site accepts it and every password manager handles it without fuss. Guidance such as NIST's emphasises length above composition tricks.
How strong is a random 16-character password?
With letters, digits and symbols (about 94 possibilities per character), 16 characters give roughly 104 bits of entropy — around 2 × 10³¹ combinations. Even an attacker testing a trillion guesses per second would need billions of years on average.
What if a site only allows 12 characters?
Use the maximum the site allows and enable every character class. Twelve random characters from the full set still give about 78 bits — strong against online attacks, though 16 remains the better default where accepted.
Should every account get its own 16 characters?
Yes. Uniqueness matters as much as length: a breach at one site must not unlock your email. Generate a fresh password per account and let a password manager remember them.
Is the password stored anywhere?
No. It is generated in your browser and exists only in the page until you copy it. Nothing is transmitted or logged.
Related tools
- Password generator — Create strong, random passwords with cryptographic randomness. Everything runs in your browser; nothing is uploaded or stored.
- Random Password Generator — Generate a truly random password in your browser — no patterns, no dictionary words, nothing to guess. Nothing is uploaded or stored.
- Strong Password Generator — Create a strong password and see exactly how strong it is, measured in bits of entropy. Free, private, no sign-up.
- Secure Password Generator — Generate passwords the secure way: drawn from your browser's cryptographic random number generator, created on your device, and never transmitted or…
- JSON formatter, Base64 & URL codec — Format valid JSON and encode or decode UTF-8 Base64 and URL components in your browser.
- JSON workbench — editor, viewer & validator — Edit JSON on the left and inspect it live on the right: validate with exact line-and-column errors, format, explore a collapsible tree, run JSONPath queries and convert to CSV, XML or YAML.
- QR code generator — Turn text or URLs into QR codes with selectable size and error correction. Download as PNG or SVG, all locally.
- Word counter — Count characters, words, lines and paragraphs, and estimate reading time. Paste text or load a .txt file.
- UUID generator — Generate bulk UUID v4 identifiers with cryptographic randomness. Copy the list or download it as text.
- Timestamp converter — Convert Unix timestamps to readable dates and back. Handles seconds and milliseconds, UTC and local time.