Password Generator
Generate strong, cryptographically secure passwords instantly.
Weak or reused passwords are the leading cause of account breaches. This generator creates strong, unique passwords using your browser's cryptographic random number generator — the same entropy source used by security-critical applications. Choose your length, character types, and exclusions, then copy a password that would take centuries to brute-force.
How to Use the Password Generator
- Set the length — drag the slider to choose between 4 and 128 characters. For most accounts, 16–20 characters is ideal.
- Choose character types — tick uppercase (A-Z), lowercase (a-z), numbers (0–9), and symbols (!@#$…) for maximum strength.
- Click "Generate Password" — a new cryptographically secure password appears instantly.
- Check the strength meter — see the entropy in bits. Aim for at least 80 bits (Strong) for important accounts.
- Copy and use — click the Copy button and paste it into your password manager or account settings.
Password Length vs. Crack Time (the honest math)
Password strength is measured in entropy bits: bits = length × log₂(alphabet size). Here is what a modern offline attack (~1 trillion guesses/second) does to common choices:
| Password | Entropy | Time to crack |
|---|---|---|
| 8 chars, lowercase only | ~38 bits | under 1 second |
| 8 chars, all types (94 symbols) | ~52 bits | ~1.5 hours |
| 12 chars, all types | ~79 bits | ~15,000 years |
| 16 chars, all types | ~105 bits | ~1012 years |
| 4-word passphrase (7,776-word list) | ~52 bits | ~1.5 hours* |
| 6-word passphrase | ~78 bits | ~12,000 years |
*Passphrase times assume the attacker knows you used a word list (worst case). Length beats complexity: adding 4 characters multiplies crack time by ~78 million; swapping a→@ barely moves it.
Practical Rules That Actually Matter
- 16+ characters for anything important — email, banking, password manager master password.
- Unique per site. Reuse is how breaches spread; one leaked database unlocks every account sharing that password.
- A password manager beats memorisation. Generate 20-character random passwords here, store them there, remember only the master passphrase.
- Skip forced rotation. Current NIST guidance (SP 800-63B) says change passwords when compromised, not on a schedule — scheduled changes push people toward weak patterns like
Summer2026!. - Turn on 2FA anyway. Even a perfect password can be phished; a second factor caps the damage.
Frequently Asked Questions
crypto.getRandomValues) which provides cryptographically secure random numbers. This is the same level of randomness used by security software and operating systems.📖 Further reading: Password Entropy Explained: How Strong Is Your Password?