How to use the generator
- Pick a type: a random password for important accounts, a passphrase you can memorise, or a numeric PIN for devices.
- Set the length with the slider. Longer is dramatically stronger.
- Enable the character types you want. Turning on all four gives the strongest result.
- Check the strength meter and crack-time estimate below the password.
- Copy it and save it straight into a password manager.
Why this tool is safe
The password is generated entirely inside your browser using crypto.getRandomValues(), the browser standard cryptographic random source. There is no network request involved, and your password cannot appear in any server log because it never left your device.
What actually makes a password strong?
Real strength comes from randomness and length, not from looking complicated. Something like P@ssw0rd! appears complex but is among the first things a cracking tool tries, because it is a dictionary word with predictable substitutions.
Factor one: length
Every extra character multiplies the difficulty. Going from 8 to 16 characters does not double the strength — it increases it astronomically:
| Length | Entropy | Estimated crack time |
|---|---|---|
| 8 characters | ~52 bits | Hours to days |
| 12 characters | ~78 bits | Thousands of years |
| 16 characters | ~104 bits | Millions of years |
| 20 characters | ~131 bits | Practically uncrackable |
Factor two: genuine randomness
Humans are extremely poor at being random. We reach for birthdays, names and keyboard patterns. A cryptographic random generator has none of those biases.
For example, a 16-character password from a 94-symbol pool gives 16 × log₂(94) ≈ 105 bits, which is excellent.
Passphrases: strong and memorable
A passphrase is several random words joined together, such as Harbour-Copper-Lantern-Drift. It is both long and genuinely easy to remember.
Its strength depends on how many words you use and how large the list they came from is. This tool uses a 256-word list, which is exactly 8 bits per word:
| Words | Entropy | Verdict |
|---|---|---|
| 4 words | 32 bits | Weak — cracked in seconds |
| 6 words | 48 bits | Acceptable for low-value accounts |
| 8 words | 64 bits | Good |
| 10 words | 80 bits | Strong |
Careful: a short passphrase is not secure The familiar advice that "four words is enough" assumes a very large list of several thousand words. With a smaller list you need more words. Use at least 7 words here, and always judge by the entropy reading rather than the word count alone.
When to use which Use a passphrase for the handful of passwords you must hold in your head: your device login and your password manager master password. Use a long random password for everything else, since your password manager remembers those for you.
Common password mistakes
- Reusing the same password: by far the most dangerous habit. One breached site opens every other account, an attack known as credential stuffing.
- Predictable substitutions: swapping a for @ and o for 0 does not fool cracking tools — they try those patterns first.
- Personal information: your name, birthday or company is usually discoverable on social media.
- Forced periodic changes: making people change passwords monthly pushes them toward weak, predictable patterns. Modern guidance (NIST) advises against forced rotation unless a compromise is suspected.
- Storing them insecurely: a text file, a chat message, or a note stuck to the monitor.
- Relying on the password alone: always enable two-factor authentication where it is offered.
How to store passwords safely
Do not try to memorise dozens of different passwords — it is not realistic, and it is exactly what drives people to reuse them.
- Use a password manager: it generates, stores and fills passwords automatically, and you only need to remember one master password.
- Make the master password a long passphrase that you know well and use nowhere else.
- Enable two-factor authentication on your password manager and your email before anything else — email is the recovery key to every other account.
- Check for breaches periodically using a reputable breach-notification service, and change any password that appears in one immediately.
How is crack time calculated?
The estimate shown assumes an offline brute-force attack at 100 billion guesses per second, roughly what dedicated hardware achieves against a weak hash.
Time = Combinations ÷ 2 ÷ 100,000,000,000
We divide by two because, on average, a password is found after trying half the possibilities.
Treat the number as indicative, not a promise Real-world time depends on the site hashing algorithm and the attacker hardware, neither of which you control. More importantly, passwords are rarely broken by brute force at all — they are lost to phishing, breaches and reuse.
Frequently asked questions
Are the passwords generated here safe?
Yes. They are generated in your browser using the standard crypto.getRandomValues() API, are never sent to a server and are never stored. Their safety still depends on your device, so avoid generating passwords on public or shared computers.
How long should a password be?
Use at least 16 characters for important accounts and 12 as an absolute minimum anywhere. Length is the single biggest factor in strength, and each extra character multiplies the difficulty.
Is a random password better than a passphrase?
A random password is far stronger per character. A 16-character random password gives about 103 bits, while a 7-word passphrase gives about 56 bits. Use a long random password for accounts your password manager remembers, and a long passphrase (7 words or more) for the few you must recall yourself.
Is anything I generate sent to a server?
No. The tool runs entirely in your browser in JavaScript and makes no network request when generating. You can disconnect from the internet and it will keep working.
Should I change my passwords regularly?
Modern guidance such as NIST no longer recommends forced periodic changes, because it pushes people toward weaker patterns. Change a password immediately if you suspect compromise or it appears in a breach.
What does entropy in bits mean?
It is a mathematical measure of how many possibilities exist. Each additional bit doubles that number. Around 60 bits is acceptable, 80 is good, and over 100 bits is excellent for personal use.
Why would I exclude look-alike characters?
Because l, I, 1, O and 0 are hard to tell apart when read or typed by hand. Excluding them helps for passwords you will read visually, though it slightly reduces strength by shrinking the character pool.
Last updated: