15 character password generator
Made on your device. Never sent or stored.
A random 15 character password, generated on your device. Change the character types below; the length stays at 15 unless you move it.
Is 15 characters long enough?
Fifteen characters is the minimum NIST SP 800-63B-4 sets for a password used as the only authentication factor. The final version was published on 31 July 2025, and verifiers following it must require at least 15 characters in that case.
When to use it: The length to choose when a password is the only thing protecting an account, and the length to set as the minimum if you write a password policy.
How strong is a 15 character password?
A random 15 character password from letters and digits has 89.3 bits of entropy. With symbols added it has 96.6. Here is how that translates into guessing time for each character set.
| Characters | Pool | Bits | Fast hash | Slow hash |
|---|---|---|---|---|
| Digits only | 10 | 49.8 | 14 hours | 1,584 years |
| Lowercase letters | 26 | 70.5 | 2,657 years | 3 billion years |
| Letters, both cases | 52 | 85.5 | 87 million years | 87 trillion years |
| Letters and digits | 62 | 89.3 | 1 billion years | 1 quadrillion years |
| All four types (this site) | 87 | 96.6 | 196 billion years | 196 quadrillion years |
These figures only hold for random passwords like the ones above. A 15 character password you made up, with words, names or dates, is guessed far sooner. Test one with the strength checker.
Questions
How many combinations does a 15 character password have?
With the 87 characters used here, 87 to the power 15, about 1029. With letters and digits only, 62 to the power 15, about 1026.
Is this password stored anywhere?
No. It is generated in your browser with the Web Crypto API and never sent to a server.
Sources
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.