What next?
A strong password, then the maths behind why it is strong.
How to use this tool
- Set the length and which character types to include.
- A strong random password generates instantly.
- Copy it — nothing is sent anywhere.
What your result means
The strength indicator is a measure of entropy — how many guesses an attacker would need on average, given they know exactly how the password was generated. It is a property of the generating method and length, not of how complicated the password looks to you. A 20-character password of random lowercase letters is far stronger than an 8-character one with a symbol and a number bolted on.
Length does more work than character variety. Each extra character multiplies the search space, while adding one symbol type only widens it a little. The practical reading: anything under about 60 bits should be treated as short-term only, 80 bits or more is comfortable for an account that matters, and the real protection is not reusing it anywhere else.
Why this one is different
Strength is stated as entropy from the alphabet actually in use — sixteen characters drawn from a pool of eighty is about 101 bits — and the bar moves the instant a character set is switched off, because the pool shrinks with it. Look-alike characters are left out of every set, and the figure counts what remains rather than a textbook 26 plus 26 plus 10.
Why "password123" is cracked in under a second
Modern computers guess billions of passwords per second, so a short or common one falls instantly. Length and randomness are everything — each extra character multiplies the time to crack, turning seconds into centuries.
The safest password is one you never have to remember: generated randomly, unique to each site, and stored in a password manager. This tool builds them without ever leaving your browser.
How it works
Passwords are built from the character sets you enable, using your browser's cryptographically secure random generator. Nothing is sent anywhere — the password is created and stays on your device. Longer passwords with more character types are exponentially harder to crack.
What actually makes a password strong
Length, not complexity. Each additional character multiplies the number of possibilities, while substituting a with @ adds almost nothing — attackers' tools have known that trick for decades. A random 16-character password from a 72-character alphabet has around 98 bits of entropy, which is far beyond brute-force reach. The weak points are reuse across sites and predictable human patterns, not the absence of a punctuation mark.
Worked example
Comparing four passwords by entropy rather than by how complicated they look:
12 characters, letters + digits 70 bits
16 characters, full symbol set 101 bits
20 characters, lowercase only 93 bits
The last two lines are the point. Twenty lowercase letters — no symbols, no digits, nothing awkward to type on a phone — land within touching distance of sixteen characters drawn from the entire keyboard, and both dwarf the eight-character password that looks the most "secure". Each added character multiplies the search space; each added character type only widens it slightly. Length wins.
Frequently asked questions
Are these passwords safe to use?＋
Yes. They're generated locally with a secure random source and never transmitted. For best security, use a unique password per site and store them in a password manager.
How long should a password be?＋
At least 12–16 characters with mixed types. Longer is stronger — the strength meter updates as you adjust the settings.
Is a long passphrase better than a short complex password?＋
Usually yes. Four or five random words give more entropy than a short string of mixed symbols and are far easier to type and remember. Length beats complexity once a password is genuinely random.
Should I use a password manager?＋
Yes. The main risk in practice is reuse across sites, not the strength of any single password. A manager makes every password unique, which is the single biggest improvement most people can make.
How often should passwords be changed?＋
Only when there is a reason: a breach, a shared password, or a suspicion of compromise. Scheduled rotation tends to push people towards predictable variations, which is why NIST no longer recommends it.
Are the passwords generated on my device?＋
Yes. Generation uses the browser's cryptographic random source and nothing is transmitted or logged.
Related tools
Assumptions & limitations
Some limits worth knowing before you rely on a generated password:
- Passwords are generated in your browser using the Web Crypto random source. Nothing is transmitted, logged or stored.
- Strength estimates assume an attacker who knows the generation method but not the output — the standard and correct assumption.
- A strong password does not protect an account whose provider is breached. Use a different password everywhere, and enable two-factor authentication where it is offered.
- Current NIST guidance recommends length and screening against known-breached passwords over forced complexity rules and routine expiry.