How to Use a Random Generator to Create the Best Passwords

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

You’ve heard it a million times—use a long, strong, unique password for every single one of your online accounts. But memorizing even one password like Py4"qIme%F[pGmbe is too hard for most of us. Memorizing dozens of them? Fuhgeddaboudit! You need the help of a password manager to record those gibberish strings and to help you come up with new, strong, random ones.

Every password manager worth its salt includes a password generator component, so you don't have to create those random passwords yourself. However, not all password generators are the same. When you know how they work, you can choose the one that's best for you and learn the best practices for using the one you have. And if you wind up wanting a do-it-yourself solution, we'll show you how to build your own random password generator.

How Do Random Password Generators Work?

When you spin a roulette wheel, you get a truly random result. Nobody can predict whether the little ball will bounce into rouge, noir, or double zero. But physical randomizers like roulette wheels and dice don’t exist in the digital realm. The HotBits API, which returned random numbers based on radioactive decay, came close but was retired in 2023. Like hardware random number generators, it was meant for scientists and cryptographers, not for average consumers and their password managers.

Password managers and other computer programs use what's called a pseudo-random algorithm. This algorithm starts with a number called a seed. The algorithm processes the seed and gets a new number with no traceable connection to the old, and the new number becomes the next seed. The original seed never turns up again until every other number has been used. If the seed was a 32-bit integer, that means the algorithm would run through 4,294,967,295 other numbers before a repeat.

The Best Password Managers We've Tested

This is fine for everyday use and fine for most people's password generation needs. However, it's theoretically possible for a skilled hacker to determine the pseudo-random algorithm used. Given that information and the seed, the hacker could conceivably replicate the sequence of random numbers (though it would be difficult).

That sort of laser-focused hacking is extraordinarily unlikely except in a dedicated nation-state attack or corporate espionage. If you're the subject of such an attack, your security suite probably can't protect you. Fortunately, you're almost certainly not the target for this kind of cyberespionage.

A few password managers actively work to eliminate the remotest possibility of such a focused attack. By incorporating your own mouse movements or random characters into the random algorithm, they obtain a truly random result. As shown above, Password Depot makes the randomization process visible in a Matrix-style display. With Steganos, you move your mouse across a world map to introduce randomization. The free KeePass lets you “collect entropy” from mouse movements or random keystrokes to fully randomize its generated passwords.

Do you really need to add real-world randomization? Probably not. But if it makes you happy, go for it!

Don’t Let a Password Manager Reduce Randomness

Of course, password generators don't literally return random numbers. Rather, they return a string of characters, using random numbers to choose from the available character sets. You should always enable the use of all available character sets unless you're generating a password for a website that doesn't allow special characters.

The pool of available characters includes 26 uppercase letters, 26 lowercase letters, and 10 digits. It also includes a collection of special characters that may vary from product to product. For simplicity, let's say there are 18 special characters available. That makes a nice round total of 80 characters to choose from. In a totally random password, there are 80 possibilities for every character. If you choose an eight-character password, the number of possibilities is 80 to the eighth power, or 1,677,721,600,000,000—more than a quadrillion. That's tough slogging for a brute-force cracking attack, and brute-force guessing is really the only way to crack a truly random password.

Of course, a totally random generator will eventually produce aaaaaaaa and Covfefe! and 12345678, since these are just as likely as any other sequence of eight characters. Some password generators actively filter their output to avoid such passwords. That's fine, but applying these filters reduces the total number of possibilities and makes brute-force cracking fractionally easier. That is, if the hacker knows the filter is in place.

Here's an extreme example. There are 40,960,000 possible four-character passwords, drawing from a collection of 80 characters. But some password generators force the selection of at least one from each type of character, which drastically shaves down the possibilities. With 10 digits, 18 symbols, and 26 apiece of capital and small letters, there are 10x18x26x26 possibilities. However, each bunch of four characters can appear in 24 different orderings, so the total number of distinct four-character passwords having all four types is 2,920,320. The use-all-types restriction eliminated all but about 7% of the possibilities.

Many websites require using all character sets. Set the password length high to avoid letting that requirement shrink your password pool significantly. When the password is long enough, the effect of forcing all character types becomes negligible.

By default, the password generators in LastPass and several others entirely omit ambiguous character pairs such as the digit 0 and capital O or the digit 1 and small l. This isn't necessary when you don't have to type the password from memory, so please turn off this option. Likewise, don't choose the option to generate a pronounceable password like aCAtOReWIDEa. That option is only important if it's a password you must remember. Applying this option not only limits you to alphabetic characters, it rejects the vast number of possibilities the password generator deems unpronounceable.

Bitdefender’s password manager, available as a standalone app or part of Bitdefender Total Security, has one very unusual feature. As with other password generators, you can choose which character sets it should use. But you can also edit those character sets. Perhaps you hate passwords that contain the digit 4. Maybe you want to celebrate your Teutonic heritage by including vowels with umlauts in your passwords. Realistically, the only time you’ll really need this feature is when you hit a website that only accepts a subset of the available special characters—and then you’ll love it.

Why You Should Use Long Passwords

As we've seen, password generators don't necessarily choose from the pool of all possible passwords matching the length and character sets you selected. In the extreme example of a four-character password using all character sets, about 93% of possible four-character passwords never appear. The solution is simple: go long! You don't have to remember these passwords, so they can be huge. At least, as huge as the website in question accepts, some impose limits on length.

The bigger the search space (what I've been calling the pool of available passwords), the longer it would take a brute-force attack to happen upon your password. You can play with the Password Haystack Calculator (as in, needle in a haystack) at the Gibson Research website to get a feel for the value of length.

Just enter a password to see how much time would be needed to crack it. The site promises, "NOTHING you do here ever leaves your browser. What happens here, stays here." But caution suggests you avoid using your actual passwords. If the hacker must send guesses online, a four-character password like f%J3 would take not quite one day to crack. But in an offline scenario, where the hacker can try guesses at high speed, cracking time is a fraction of a second.

In my article on creating memorable strong passwords (for things like a password manager's master password) I suggest a mnemonic technique that transforms a line from a poem or play into a random-looking password. For example, a line from Romeo and Juliet, Act 2, Scene 2, became bS,wLtYdWdB?A2S2. This is not a random password, but a cracker doesn't know that. Dropping it into Gibson's calculator, we learn that even using a massive cracking array, it would take 1.41 hundred million centuries to brute-force this one.

That’s good, right? Yes, but consider the password in the preceding screenshot, My-Password-Is-Long. The calculator says brute-forcing this one would take over 14 trillion centuries, even though it omits all the digits. Make it long!

So now you know—the most important factor in generating strong, random passwords is to make them long. Some password generators reject passwords that don't contain all character sets, some reject those with embedded dictionary words, some discard passwords that contain ambiguous character like small l and digit 1. All these restrictions limit the pool of possible passwords, but when the length is high enough, the limitations become irrelevant.

Of course, it's theoretically (if not practically) possible that some evil brainiac might hack the password generation scheme of your favorite password manager and thereby gain the ability to predict the pseudo-random passwords it will offer you. It’s even remotely possible that a shady password manager app could send your random passwords back to company headquarters. This is really in the tinfoil-hat paranoia level of concern. But if you really don't want to rely on someone else for your random passwords, we’ve got you covered there, too. Click through for our instructions to create your own random password generator in Excel.