Password Generator
Generated with your browser's cryptographic random number generator, never sent anywhere, and rated by actual entropy in bits rather than a coloured bar that turns green when you add an exclamation mark.
Password Recipe
Turn character sets on and off — the entropy figure updates with them.
crypto.getRandomValues() — the browser's cryptographic random source, not Math.random(). Nothing is transmitted or logged.Entropy is the only honest strength measure
A password's strength is how many guesses an attacker must make on average, and that is set by two things: how many characters are in the pool, and how many positions you filled. The formula is log2(poollength), giving a figure in bits. Each extra bit doubles the work. A 20-character password drawn from all four sets above is around 131 bits, which is far beyond what any attacker can brute force with current or foreseeable hardware.
This only holds if the characters are genuinely random. “P@ssw0rd!” has nine characters from a 94-character pool, which looks like 59 bits — but it is a dictionary word with predictable substitutions, so a real cracking tool finds it in seconds. Entropy measures the process that produced the password, not the characters that came out of it.
Length beats complexity, every time
Adding one character to a lowercase-only password multiplies the search space by 26. Adding symbols to an eight-character password multiplies it by about 3.7 in total. If you have to choose one, choose length. This is why NIST's current guidance (SP 800-63B) tells organisations to allow passwords up to at least 64 characters and to stop forcing composition rules and periodic rotation — both push people toward predictable patterns.
Why the cracking estimates are deliberately pessimistic
The offline figure assumes 1011 guesses per second, which is roughly a well-funded GPU rig attacking a fast hash such as unsalted SHA-1. A password stored properly with bcrypt, scrypt or Argon2 is many orders of magnitude slower to attack. The pessimistic number is the useful one: you do not get to choose how the service that leaked your password was storing it.
Use a password manager
A password is only doing its job if it is unique to one site, and nobody memorises dozens of 130-bit strings. Generate, store in a manager, and keep exactly one strong passphrase in your head for the vault itself. Turn on two-factor authentication wherever it is offered — it defends you even when a password does leak.
Frequently Asked Questions
Are these passwords sent anywhere?
How many bits of entropy is enough?
Is a passphrase better than a random string?
Why avoid characters like 0, O, 1, l and I?
Sources
Official publications only. Links open the original document in a new tab.
- National Institute of Standards and Technology SP 800-63B — Digital identity guidelines: authentication SP 800-63B password and entropy guidance