Skip to content
Constraint preset

Alphanumeric password generator

An alphanumeric password uses only A-Z, a-z, and 0-9: a pool of 62 characters. It is the safest common denominator, because virtually every system on earth accepts all 62 without truncating, escaping, or rejecting anything.

Very strong95.3 bits of entropy

Offline attack on a fast hash: 8 billion years

Beyond the reach of brute force. Your risk is now phishing and reuse, not guessing.

16
Include

Generated in your browser with crypto.getRandomValues. Nothing is sent to a server, logged, or stored.

Entropy
95.3 bits
Character pool
62 symbols
Equivalent full-set length
15 chars
GPU, fast hash
8 billion years

When you need this

API keys, database credentials, Wi-Fi passwords typed on a TV remote, and any field where you are not certain how the system handles punctuation.

What the restriction costs you

62 characters instead of 86. At 16 characters that is 95 bits rather than 103 — a difference with no practical consequence, since both are far beyond brute force.

In concrete terms: this page generates 16 characters from a pool of 62, which is 95.3 bits — the same strength as a 15-character password using the full 86-symbol set. The constraint is not the problem people assume it is, as long as you compensate with length.

Why sites reject passwords without telling you

A rejected password is almost never about strength. The usual culprits, roughly in order of how often they bite:

  • An undisclosed maximum length. Plenty of systems silently cap at 16 or 20 characters, and some truncate rather than reject — so the password is accepted at signup and then fails at login.
  • A symbol the backend cannot handle. Quotes, backslashes, angle brackets, and semicolons break naive input handling, so they get banned wholesale.
  • Leading or trailing spaces that get trimmed on one screen and not the other.
  • A similarity rule forbidding your name, email, or a previous password — usually unstated.
  • A paste block on the confirmation field, which turns a correct password into a typo.

If a password fails and you cannot tell why, try this generator's output first, then shorten it. Those two moves resolve the large majority of cases.

How long this password survives each attack

"Time to crack" is meaningless without naming the attack. The same password fails in an afternoon or outlives the sun depending on how the website stored it. These are average times — half the keyspace — for this password:

Estimated average crack time by attack scenario for this password configuration
Attack scenarioGuesses / secondAverage time
Throttled login form10010^18 years
Stolen database, unsalted fast hash100 billion8 billion years
Stolen database, PBKDF2 with 600,000 iterations~167,00010^15 years

The third row is why key stretching matters so much. MoolKey runs PBKDF2 at 600,000 iterations for the same reason: it costs you a fraction of a second and costs an attacker a factor of 600,000.

You still have to keep it somewhere

A 16-character random string is not memorable, and pretending otherwise is how people end up with a sticky note. Either store it in a password manager, or use a generator that can recreate it on demand from one phrase you already remember — which means there is no stored copy for anyone to steal.

Common questions

Why would a site reject my password?
Almost always because of an undocumented rule: a maximum length you were not told about, a symbol the system cannot store, a space that gets trimmed, or a requirement that the password not contain your name or email. Sites rarely explain which rule you broke, which is why a generator you can constrain is useful.
Is a password without symbols still secure?
Yes, if you add length. Dropping symbols takes the pool from 86 characters to 62, costing about 0.47 bits per character. Two or three extra characters more than covers the difference, and this page already accounts for that.
How strong is this 16-character password?
It carries 95.3 bits of entropy from a 62-character pool — equivalent to a 15-character password using the full symbol set. Against an offline attack on a fast hash at 100 billion guesses per second, the average time to crack it is 8 billion years.
Is this generator safe to use?
Yes. It runs entirely in your browser using crypto.getRandomValues, the cryptographic random source provided by your operating system. Nothing is transmitted, logged, or stored, and it keeps working with the network disconnected.

More free tools

Every tool runs in your browser without an account. The generators, strength checker, and entropy calculator keep inputs local. The breach checker sends only a five-character hash prefix to Have I Been Pwned.

Make one account easier today.

Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.

Open MoolKey freeRead how it works
Free forever Works offline Phone or computer