16-Character Password Generator
Create a random 16-character password. The length is pre-filled, and you can still adjust it if this site allows more.
This page generates 16-character passwords, which is the default we recommend for almost everything. With all four character classes selected the search space is about 103 bits, and the strength meter above shows how much of that you keep after any option you turn off.
The length field starts at 16 but is not locked. Sites have different limits, and a generator that refuses to go beyond a preset number is a demo, not a tool.
How to use it
- Leave the length at 16, or change it if the site you are signing up for has a different limit.
- Untick any character class the site rejects — some still refuse symbols.
- Copy the password straight into your password manager, not into a notes app.
Why 16 characters
A 16-character password drawn from all 88 printable characters carries roughly 103 bits of entropy. Each additional character multiplies the search space by 88, which is why length matters far more than the exotic look of the symbols.
Use 16 characters for email, banking, work SSO and password manager entries. Avoid it for nothing in practice — 103 bits is beyond any realistic offline attack.
Reviewed 2026-10-21. This tool runs entirely in your browser — no server, no account, and nothing you generate is stored.
Frequently asked questions
Is 16 characters overkill for a normal account?
No. The cost of extra length is zero to you if you use a password manager, and 16 characters is still short enough to type manually from a phone when you have to.
Does a 16-character password with symbols beat a longer one without?
No. Length wins. Adding four characters multiplies the search space by 88^4 (about 60 million) while adding a symbol class only multiplies it by roughly 1.35. If a site forces you to drop symbols, add length instead.
Are these passwords generated on your server?
No. There is no server involved. The characters come from your browser's crypto.getRandomValues(), and the page never makes a network request with the result.
What if the site truncates my password silently?
A few old systems cap input at 16 or 20 characters. If you paste 16 characters and the login later fails, try logging out and back in immediately after saving — that is the only reliable way to detect truncation.
Related tools
More from Passwords.