The cleanest way to generate a password in Google Password Manager with a specific length and character set is to roll a strong random string with a local browser tool that uses a cryptographically secure random number generator, copy the result, and paste it into Google Password Manager's Add password flow. Google Password Manager's built-in suggester can create a random password in a single click when you sign up for a new account in Chrome, but it does not expose the underlying length, the character classes that go into the pool, or the entropy of the result. A standalone, CSPRNG-backed generator gives you full visibility and control: you pick the length, toggle which character types to include, optionally exclude visually ambiguous characters like 0, O, 1, and l, read the entropy estimate the tool shows, then copy. Password Generator runs entirely in your browser, draws every character from the platform's crypto.getRandomValues API, and uses rejection sampling rather than naive modulo arithmetic so every character in the pool is chosen with exactly equal probability. Because generation happens locally, the password is never transmitted, logged, or stored on a server; it exists only inside the tab until you close it.
That local-only design is what makes a browser-based generator suitable for filling Google Password Manager with a password you can fully specify, instead of accepting whatever Chrome's on-the-fly suggester hands you.
When you need a generator instead of Chrome's built-in suggester
Chrome's password suggester is convenient but opaque. When you click into a "new password" field, Chrome rolls a random string and offers to save it. You do not get to choose the length (it is usually 15), you do not see which character classes are included, and you do not see an entropy figure. If the site disables the suggester, if your organization has policies that require a specific length or composition, or if you are pre-creating a password to import into Google Password Manager from another device, you need a generator that exposes every dial.
A local generator also helps when you want to see and verify what you are about to save. You can pick 20 characters with all four character classes, watch the entropy readout jump past 120 bits, regenerate until the result is acceptable, and then copy with confidence. The same workflow is hard to replicate when Chrome has already inserted a value into the password field and is waiting for you to accept or reject it.
Generate the password in three steps
- Set the length. Use the slider or the number box. Longer passwords are stronger because entropy scales linearly with length while the character pool is fixed. A good default is 16; for accounts that matter, push to 20 or higher.
- Toggle the character types. Turn on uppercase, lowercase, digits, and symbols. Leave "exclude ambiguous characters" enabled if you ever plan to type the password by hand, since it drops 0, O, 1, and l from the pool at a small entropy cost.
- Read the strength readout, then click Generate new password. If the result is fine, click Copy. The password now sits on your clipboard, ready to paste into Google Password Manager or directly into a sign-up form.
Behind the scenes, the tool draws uniform random integers from the browser CSPRNG, applies rejection sampling to remove modulo bias, guarantees at least one character from every selected class, and shuffles the result with Fisher–Yates so the guaranteed characters are not pinned to predictable positions. You do not have to remember any of that to use the tool, but it is the reason a 16-character output from this generator carries close to 103 bits of entropy rather than a length that only looks strong.
Save the new password into Google Password Manager
Once the password is on your clipboard, open Google Password Manager. The fastest route in Chrome is the menu (three dots) → Google Password Manager → Add (the plus button). On a phone, open the Google Password Manager app, or go to Settings → Passwords & accounts → Google → Password Manager on Android, or Settings → Passwords on iOS. Fill in the site URL, the username or email, and paste the generated password into the password field. Hit Save.
If you are creating the password during a real sign-up, Chrome's suggester may pop up as soon as you focus the password field. Decline the suggested value, paste your generated password, and Chrome will offer to save it on submit. From that point on, Google Password Manager fills it on every sign-in, and the encrypted copy syncs across every device where you are signed in to Chrome with sync enabled.
Entropy, length, and how strong is strong
Password strength is measured in bits of entropy. With all four character classes enabled the tool draws from a pool of 86 distinct characters, so each position contributes log2(86) ≈ 6.43 bits. A 16-character password from that pool therefore carries 16 × 6.43 ≈ 103 bits, while a 12-character one from the same pool lands near 77 bits. Length is the single biggest lever: doubling the character count from 12 to 24 nearly doubles the entropy, while swapping a 24-character lowercase string for an 8-character one packed with symbols actually lowers it. That is the basis of modern guidance from NIST SP 800-63B and the OWASP authentication cheat sheet, which both favor long, random strings over forced complexity rules.
The table below maps entropy ranges to the rough strength buckets the tool reports.
| Entropy | Strength |
|---|---|
| Under 60 bits | Weak |
| 60 to 100 bits | Fair |
| 100+ bits | Strong against offline brute-force attacks |
Character pool sizes the tool relies on are summarized below. These are fixed values defined by the ASCII character set and the tool's configuration, not computed results.
| Character set | Pool size |
|---|---|
| Uppercase A–Z | 26 |
| Lowercase a–z | 26 |
| Digits 0–9 | 10 |
| All four classes combined | 86 |
What to do after the password is saved
Use a unique password for every site. Reusing a strong password still fails the moment one of those sites is breached, because attackers feed the leaked email and password pairs into credential-stuffing tools against every other major service. Google Password Manager's built-in breach alerts and the Password Checkup tool will warn you when a saved password shows up in a known leak; treat that warning as a prompt to roll a new one and update the saved entry.
Turn on two-factor authentication for any account that supports it, especially the Google account itself. A long, random password protects the account against guessing, while two-factor authentication protects it against the password leaking. The combination is what current NIST guidance and the OWASP authentication cheat sheet both recommend.
Finally, do not memorize the generated password. The whole point of using a manager is that the password is too long and too random to hold in working memory, and the manager remembers it for you. Closing the tab on the generator page discards the only copy that ever existed on your device, so the only persisted version is the one Google Password Manager stored encrypted in your account.