Password Generator
Strong random passwords and passphrases with an entropy readout.
What actually makes a password strong
Not exclamation marks. The only thing that matters against a serious attacker is entropy — the number of equally likely possibilities your password was drawn from, measured in bits. Each extra bit doubles the work required to guess it. A password chosen uniformly at random from 94 printable characters carries about 6.5 bits per character, so 20 characters is roughly 131 bits: unbreakable with any foreseeable technology.
Human-chosen passwords carry far less. P@ssw0rd! looks complicated and satisfies every corporate complexity rule, but it is one of the first few thousand guesses any real cracking tool makes, because the substitutions are entirely predictable. Randomness has to come from a machine, which is what the generator above does.
Length beats complexity
Adding one character to a random password multiplies the search space by the alphabet size. Adding a symbol to a short one barely moves it. If you have to choose, choose longer. A 16-character lowercase-only password (75 bits) is dramatically stronger than an 8-character password using every symbol on the keyboard (52 bits) — and much easier to type on a phone.
Passphrases
A passphrase draws whole words at random from a fixed list, which trades a little length for a lot of memorability. The strength comes purely from how many words are chosen and how large the list is, never from the words themselves being obscure. Six random words from this generator's list give around 55 bits — plenty for a device login or a password-manager master password you have to type by hand. Critically, the words must be picked by the machine: a phrase you invented yourself is a sentence, and sentences are guessable.
Practical advice
- Use a password manager and let every account get a different 20-character random password. You only need to remember one.
- Make that one a long passphrase you can type quickly.
- Turn on two-factor authentication. It defeats an attacker who already has your password, which no amount of length can do.
- Never reuse a password across sites. Credential-stuffing attacks rely entirely on reuse and are the most common way accounts fall.
- Ignore forced 90-day rotation. It pushes people toward
Summer2026!thenAutumn2026!, which is worse than one strong password kept until there is evidence of a breach.
Frequently asked questions
Is the password sent anywhere or logged?
No. It is generated in your browser with crypto.getRandomValues(), never transmitted, and never written to storage. Reload the page and it is gone. This is the reason a password generator should run client-side — a server-side one has, at least momentarily, seen your password.
How is the crack time estimated?
From entropy alone, assuming an offline attack against a fast hash at roughly 100 billion guesses per second — a realistic figure for a small GPU cluster attacking unsalted SHA-256. Real sites using bcrypt or Argon2 are thousands of times slower to attack, so the estimate is deliberately pessimistic.
Why exclude look-alike characters?
Because I, l and 1, or O and 0, are indistinguishable in many fonts. Excluding them helps when a password has to be read aloud, copied from a screen or written on paper. It costs a small amount of entropy, which the readout accounts for.
Some sites reject my password. Why?
Usually a maximum length limit or a ban on certain symbols — both signs of poor password handling behind the scenes. Reduce the length or untick Symbols and generate again; a longer alphanumeric password is a fine substitute.
How many bits are enough?
Under 40 bits is breakable quickly. 60 bits is reasonable for an account protected by rate limiting and two-factor authentication. 80 bits or more is comfortable for anything valuable, and above 128 bits the password stops being the weakest link by a wide margin.