---
title: "Password Generator — Secure Random Passwords (NIST, NCSC, ACSC Standards)"
description: "Generate cryptographically secure passwords using browser-native crypto.getRandomValues(). Nothing sent to any server. Follows NIST (US), NCSC (UK), and ACSC (AU) password guidelines."
url: "https://worldcalculators.org/calculators/password-generator/"
canonical: "https://worldcalculators.org/calculators/password-generator/"
---

# Password Generator

Generate cryptographically secure passwords using browser-native crypto.getRandomValues(). Nothing sent to any server. Follows NIST (US), NCSC (UK), and ACSC (AU) password guidelines.

## Quick answer

NIST (US), NCSC (UK), and ACSC (Australia) all recommend 12–16 characters as the minimum for personal accounts, and 16–20+ for critical accounts (banking, primary email, work). Modern password crackers can test billions of simple 8-character passwords per second using GPU acceleration. A random 16-character password with mixed characters would take trillions of years to crack with today's hardware.

## Frequently Asked Questions

NIST (US), NCSC (UK), and ACSC (Australia) all recommend 12–16 characters as the minimum for personal accounts, and 16–20+ for critical accounts (banking, primary email, work). Modern password crackers can test billions of simple 8-character passwords per second using GPU acceleration. A random 16-character password with mixed characters would take trillions of years to crack with today's hardware.
NIST SP 800-63B (2017) reversed the old complexity rules (must contain uppercase, number, symbol) because research showed they backfired — users create predictable patterns like Password1! rather than truly random passwords. Length provides much stronger security than forced complexity. NIST now says: allow any printable character, check against breach databases, don't force periodic rotation, and focus on length.

Source: https://worldcalculators.org/calculators/password-generator/
Markdown mirror of the HTML page. Prefer this URL for RAG; the interactive calculator still lives on the HTML page.