16-character password generator
This generator creates a random 16-character password using uppercase and lowercase letters, numbers, and symbols — 102.8 bits of entropy drawn from 9.0 x 10^30 possible combinations. The recommended default. Strong enough that guessing stops being the threat.
- Entropy
- 102.8 bits
- Possible passwords
- 9.0 x 10^30
- GPU, fast hash
- 1 trillion years
- GPU, PBKDF2 600k
- 10^17 years
Is 16 characters enough?
At sixteen characters from the full symbol pool, brute force leaves the table entirely — the numbers stop being about computing time and start being about physics. From here on, your real risks are phishing, reuse, and malware on your own machine.
Compared with a 14-character password, this is roughly 7,396 times more work for an attacker — the cost of guessing grows by a factor of 86 for every single character you add.
When to use a 16-character password
Everything, unless a site rejects it. This is the length MoolKey generates by default and the one we recommend for email, banking, and any account that can reset others.
What to watch out for
Some sites silently truncate long passwords at 15 or 16 characters. If a password stops working after a change, that truncation is a likely culprit — test with a shorter one before assuming you mistyped.
How long this password survives each attack
"Time to crack" is meaningless without naming the attack. The same password fails in an afternoon or outlives the sun depending on how the website stored it. These are average times — half the keyspace — for this password:
| Attack scenario | Guesses / second | Average time |
|---|---|---|
| Throttled login form | 100 | 10^21 years |
| Stolen database, unsalted fast hash | 100 billion | 1 trillion years |
| Stolen database, PBKDF2 with 600,000 iterations | ~167,000 | 10^17 years |
The third row is why key stretching matters so much. MoolKey runs PBKDF2 at 600,000 iterations for the same reason: it costs you a fraction of a second and costs an attacker a factor of 600,000.
You still have to keep it somewhere
A 16-character random string is not memorable, and pretending otherwise is how people end up with a sticky note. Either store it in a password manager, or use a generator that can recreate it on demand from one phrase you already remember — which means there is no stored copy for anyone to steal.
16-character password questions
- Is a 16-character password strong enough?
- A random 16-character password using uppercase, lowercase, numbers, and symbols carries 102.8 bits of entropy. The recommended default. Strong enough that guessing stops being the threat. Against an offline attack on a fast hash at 100 billion guesses per second, the average time to crack it is 1 trillion years.
- How many 16-character passwords are possible?
- With a pool of 86 symbols there are 9.0 x 10^30 possible 16-character passwords. That figure only protects you if your password was chosen at random from all of them — a password you invented sits in a far smaller set that attackers search first.
- How long does it take to crack a 16-character password?
- It depends entirely on how the site stored it. On a rate-limited login form at 100 guesses per second: 10^21 years. Against a stolen database of fast hashes on a GPU cluster: 1 trillion years. Against a properly stretched PBKDF2 hash with 600,000 iterations: 10^17 years.
- Is this 16-character generator safe?
- Yes. It runs entirely in your browser using crypto.getRandomValues, the cryptographic random source provided by your operating system. No password is transmitted, logged, or stored. You can disconnect from the network and the generator still works.
More free tools
Every tool runs in your browser without an account. The generators, strength checker, and entropy calculator keep inputs local. The breach checker sends only a five-character hash prefix to Have I Been Pwned.
Passphrase generator
A passphrase is several random words joined together, such as "trout-canyon-mellow-drift".
PIN generator
A PIN generator picks digits at random instead of letting you reach for a birthday.
Strength checker
A password strength checker estimates how many guesses an attacker needs before reaching your password.
Breach check
A breach check tells you whether a password already appears in leaked data.
Entropy calculator
Password entropy measures how many guesses an attacker needs, expressed in bits.
Make one account easier today.
Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.