15-Character Password Generator: Create Secure & Random Passwords
A random 15-character password with letters, numbers, and symbols takes about 15 billion years to brute-force on a fast hash (about 1 trillion guesses per second), according to our crack-time table.
Need a different length? Try our 16 character generator.
Already have a password? Check how strong it is before you replace it.
When 15 Characters Makes Sense
CISA recommends 16 characters minimum. So why offer a 15-character generator?
Reality check: Some systems won't let you go longer.
Common 15-Character Limits
- Legacy banking systems (especially credit unions)
- Older enterprise software (SAP, Oracle legacy)
- Some WiFi routers cap at 15
- Government systems running on 20-year-old infrastructure
The Math: Is 15 Enough?
| Length | Character Set | Entropy | Time to Crack |
|---|---|---|---|
| 12 chars | Letters, numbers, symbols | 79 bits | 17k years |
| 15 chars | Letters, numbers, symbols | 98 bits | 15 billion years |
| 15 chars | Letters and digits only | 89 bits | 24 million years |
| 16 chars | Letters, numbers, symbols | 105 bits | More than a trillion years |
Those times are brute-force ceilings for a random password on a fast hash (about 1 trillion guesses per second), matching the crack-time table. If you invent the password, none of these numbers apply.
When to Go Longer
Use 16+ characters for:
- • Primary email account
- • Password manager master password
- • Banking and financial accounts
- • Any account without MFA
Bottom line: 15 characters is secure. 16 is slightly better. Either beats the 8-character passwords 80% of people still use.
Need 16 characters instead? • How entropy works • Read our password length research
"Why we built this: Most password tools are bloated or send your data to a server. You shouldn't need a CS degree just to stay safe., The SPG Privacy Project Read the full story →
SafePasswordGenerator is built on a simple promise: no database, and no extra software. Just browser-based math keeping you secure."
Cryptographically Secure
Uses Web Crypto API's crypto.getRandomValues() for true randomness. No pseudo-random number generators.
Client-Side Only
All password generation happens in your browser. No data is sent to our servers or stored anywhere.
Open Source
Transparent codebase you can audit anytime. Browse the GitHub repo →
What are you securing today?
Frequently asked questions
Is a 15 character password strong enough?
A random 15-character password with letters, numbers, and symbols takes about 15 billion years to brute-force on a fast hash. A 15-letter-and-digit password (no symbols) takes about 24 million years. Both beat an 8-character password by a wide margin. Invented passwords do not get these times.
Can I make a 15-digit or 15-letter password?
Yes. Open Customize. Turn symbols off for letters and digits. Turn numbers off for letters only. Some older sites ban symbols. Prefer all four types when the site allows them. Generation still uses crypto.getRandomValues() in your browser.
Should I use 15 or 16 characters?
Use 16 when the site allows it. Use 15 when it will not. Open the 16-character generator if you want CISA's recommended length.
Your Privacy is Protected
We don't collect, store, or transmit your passwords. Your passwords are generated locally in your browser using industry-standard cryptographic functions.