16 character password generator
Made on your device. Never sent or stored.
A random 16 character password, generated on your device. Change the character types below; the length stays at 16 unless you move it.
Is 16 characters long enough?
Sixteen characters is the default on this site. With all character types it carries about 103 bits of entropy, comfortably past the NIST minimum and far beyond what any offline attack can search.
When to use it: A good default for every account stored in a password manager.
How strong is a 16 character password?
A random 16 character password from letters and digits has 95.3 bits of entropy. With symbols added it has 103.1. Here is how that translates into guessing time for each character set.
| Characters | Pool | Bits | Fast hash | Slow hash |
|---|---|---|---|---|
| Digits only | 10 | 53.2 | 6 days | 15,844 years |
| Lowercase letters | 26 | 75.2 | 69,094 years | 69 billion years |
| Letters, both cases | 52 | 91.2 | 5 billion years | 5 quadrillion years |
| Letters and digits | 62 | 95.3 | 76 billion years | 76 quadrillion years |
| All four types (this site) | 87 | 103.1 | 17 trillion years | 17 quintillion years |
These figures only hold for random passwords like the ones above. A 16 character password you made up, with words, names or dates, is guessed far sooner. Test one with the strength checker.
Questions
How many combinations does a 16 character password have?
With the 87 characters used here, 87 to the power 16, about 1031. With letters and digits only, 62 to the power 16, about 1028.
Is this password stored anywhere?
No. It is generated in your browser with the Web Crypto API and never sent to a server.
Sources
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.