How to use
- Drag the slider to set the length. 16 characters or more is a reasonable default.
- Choose which character types to include.
- Turn on Exclude look-alike characters if you will read the password aloud or type it by hand.
- A new password is generated on every change — click Generate new for another.
About password strength
Password strength has one honest measure: entropy, the number of possibilities an attacker
would have to work through. It is calculated as the length multiplied by the base-2 logarithm
of the character pool size, and every additional bit doubles the work. That number is what
this tool shows, rather than a coloured bar whose rules you cannot inspect.
The most useful thing entropy reveals is that length beats complexity, decisively. Adding
symbols to a 12-character password expands the pool from 62 to about 88 characters, worth
roughly 5 bits. Adding four more characters to the same password is worth about 24 bits —
nearly five times as much. Policies that demand a symbol but cap the length at 16 have the
trade-off exactly backwards. Worse, they push people toward predictable substitutions like
P@ssw0rd!, and attackers have been modelling those patterns for decades.
The second thing worth internalising is that how a site stores your password matters more
than the password itself. Against a fast hash such as SHA-256, a modern GPU cluster tries
on the order of a trillion guesses per second. Against bcrypt or Argon2 — designed to be slow
on purpose — the same hardware manages a few thousand. That is eight orders of magnitude, and
it dwarfs any realistic difference between a good password and a slightly better one. You have
no way to know which a site uses, so the pessimistic figure is the one to plan around.
Finally, the failure mode that no generator can fix: reuse. A unique password per site is what
turns one company’s breach into one problem instead of every problem. That requires a password
manager, because 20 random characters are unmemorable by design — which is precisely why they
are worth generating.
Frequently asked questions
Is the password sent anywhere?
No. It is generated by JavaScript in your tab and never transmitted — there is no server here that could receive it. This matters more for a password generator than for almost any other tool: a password that has travelled over the network to someone else's server is a password someone else has seen.
How random is it really?
It comes from crypto.getRandomValues, which draws from the operating system's cryptographic entropy pool. The important contrast is with Math.random, which is fast but predictable — given enough previous outputs, an attacker can compute the rest. Math.random is fine for shuffling a list and unsuitable for anything an attacker would benefit from guessing.
What does the entropy number mean?
It is the base-2 logarithm of how many passwords could have been generated with those settings — 60 bits means one of 2^60 possibilities. Each extra bit doubles the search space. It is the only honest measure of password strength, and unlike the coloured strength meters on most sites, it does not depend on whether the password happens to contain a symbol in a place a heuristic likes.
Why do the two crack times differ so much?
Because the site's storage choice dominates everything else. A fast hash like SHA-256 is designed to be quick, so a GPU cluster can try on the order of a trillion guesses per second. bcrypt and Argon2 are deliberately slow, cutting that to a few thousand. The same password can be trivial or impossible depending on a decision you have no visibility into — which is why the pessimistic number is the one to plan around.
Is a longer password better than a more complex one?
Length wins, and it is not close. Adding symbols to a 12-character password takes the pool from 62 to about 88 characters, worth roughly 5 extra bits. Adding four characters to the same password is worth about 24 bits. This is why password policies that demand punctuation but cap length are counterproductive — they force memorable substitutions like a for @, which attackers have modelled for decades, while blocking the one change that actually helps.
Should I use a password manager instead of memorising these?
Yes. A generated 20-character password is unmemorable by design, and that is the point — you should not be reusing anything you can memorise. A manager also removes the real-world failure mode this tool cannot help with: the same password on many sites, so one breach opens all of them.