20-Character Password Generator
Create a random 20-character password. The length is pre-filled, and you can still adjust it if this site allows more.
This page generates 20-character passwords, which is for credentials you cannot rotate easily. With all four character classes selected the search space is about 129 bits, and the strength meter above shows how much of that you keep after any option you turn off.
The length field starts at 20 but is not locked. Sites have different limits, and a generator that refuses to go beyond a preset number is a demo, not a tool.
How to use it
- Leave the length at 20, or change it if the site you are signing up for has a different limit.
- Untick any character class the site rejects — some still refuse symbols.
- Copy the password straight into your password manager, not into a notes app.
Why 20 characters
A 20-character password drawn from all 88 printable characters carries roughly 129 bits of entropy. Each additional character multiplies the search space by 88, which is why length matters far more than the exotic look of the symbols.
Use 20 characters for disk encryption, router admin, API keys and recovery codes. Avoid it for accounts you frequently type by hand on a phone.
Reviewed 2026-10-21. This tool runs entirely in your browser — no server, no account, and nothing you generate is stored.
Frequently asked questions
When is 20 characters worth the extra typing?
When the password protects something you cannot change quickly: full-disk encryption, a router, or a root account. In those cases the inconvenience of typing is paid once, while the exposure would last for years.
Does a 20-character password with symbols beat a longer one without?
No. Length wins. Adding four characters multiplies the search space by 88^4 (about 60 million) while adding a symbol class only multiplies it by roughly 1.35. If a site forces you to drop symbols, add length instead.
Are these passwords generated on your server?
No. There is no server involved. The characters come from your browser's crypto.getRandomValues(), and the page never makes a network request with the result.
What if the site truncates my password silently?
A few old systems cap input at 16 or 20 characters. If you paste 20 characters and the login later fails, try logging out and back in immediately after saving — that is the only reliable way to detect truncation.
Related tools
More from Passwords.