Password Generator
Generate cryptographically secure passwords and passphrases. Strength and crack-time estimates included.
crypto.getRandomValues() locally.Generate cryptographically secure passwords and passphrases. Strength and crack-time estimates included.
crypto.getRandomValues() locally.Password strength is measured in bits of entropy: entropy = log₂(charset_size ^ length). A charset of 94 characters (all printable ASCII) and a length of 16 gives about 105 bits — considered very strong. Each extra character multiplies the number of possible passwords by the charset size.
Crack time is estimated assuming an attacker using 10 billion guesses per second (a modern GPU cluster) on an offline hash. The scale ranges from "instantly" for <30 bits to "millions of years" for 100+ bits. These are rough estimates — actual security depends on the hash algorithm and attacker resources.
Humans are poor at generating true randomness. We tend to use recognizable words, keyboard patterns, and predictable substitutions. A password manager lets you use a different, fully random, maximum-entropy password for every site — while you only need to remember one strong master password.
Length matters most. A random 20-character lowercase password has more entropy than a 10-character mixed-case one. Combining high length with mixed character sets (uppercase + lowercase + numbers + symbols) achieves the highest entropy. Avoid dictionary words and personal information even in "creative" substitutions — p@ssw0rd is extremely weak.
A passphrase like correct-horse-battery-staple (4 common words) has approximately 44 bits of entropy — less than a random 8-character password but far more memorable. Increasing to 6 words gives ~66 bits, and 8 words gives ~88 bits. Passphrases excel for master passwords that must be memorized.