Password Generator

Why length beats everything else

The security of a random password comes down to one thing: entropy — how many equally likely possibilities an attacker has to try. Entropy grows with the size of the character pool and multiplies with every extra character:

• Entropy in bits = length × log₂(size of the character pool).
• Lowercase only (26) at 8 characters ≈ 38 bits. Adding digits and mixed case (62) at 16 characters ≈ 95 bits.
• Each extra bit doubles the work for an attacker, so going from 40 to 80 bits is not twice as hard — it is about a trillion times harder.

That is why a long, plain-looking password is usually stronger than a short one stuffed with symbols.

What makes a password weak

• Short length. Most real-world cracking happens offline, after a site's hashes leak — an attacker with a modern GPU can try billions of guesses per second.
• Patterns. Names, dates, keyboard walks (qwerty), sports teams, and the classic `Password1!` substitution tricks are all near the top of every cracking dictionary.
• Reuse. One leaked password from an old forum unlocks every account where you reused it. Credential stuffing automates exactly this.
• Personal data. Anything visible on your social profiles — pet names, birthdays, anniversaries — is fair game for targeted guessing.

Passwords vs passphrases

A passphrase chains random words together, for example `harbor-cactus-lantern-truck-91`. It is longer than most passwords and far easier to remember or type on a phone. This generator draws from a 2,048-word list, so each word adds about 11 bits: four words is about 44 bits, six about 66 bits — plenty for a login that is rate-limited and protected by two-factor authentication. For anything guarding money or your email, prefer a full-random 16-character password stored in a password manager.

How this generator works

• Randomness comes from crypto.getRandomValues(), the browser's cryptographically secure generator — not `Math.random()`, which is predictable and unsuitable for secrets.
• If you turn on require one of each selected type, the generator guarantees at least one character from every set you picked, while the rest of the positions stay uniformly random.
• Exclude look-alike characters removes `0 O 1 l I`, which is what makes copy-by-hand errors so common.
• Everything is computed locally. Nothing is sent to a server, stored or logged, and there is no history — refresh the page and the generated values are gone.

Practical habits

• Use a different password for every account, and let a password manager remember them.
• Turn on two-factor authentication wherever it is offered — it protects you even when a password leaks.
• Aim for 16+ characters for email, banking and anything that can reset your other accounts.
• Never send a password over chat or email; share a secret through a password manager's sharing feature instead.
• Change passwords when a service reports a breach, not on a fixed calendar.

Crack-time estimates

The strength meter converts entropy into a guess count and shows how long it would take at one trillion guesses per second — roughly a serious offline attack with modern hardware. Treat it as an illustration of *scale*, not a promise: the real risk usually comes from weak passwords and reuse, not from the maths of this particular string.

FAQ

Is it safe to generate a password on a website?

Here the password is created by JavaScript in your own browser using crypto.getRandomValues(), and nothing is transmitted, stored or logged. That said, a local password manager generates and stores passwords in one step, which is more convenient for everyday use. If you want to verify this page, open your browser DevTools, switch to the Network tab and regenerate — you will see no request carrying the password.

How long should my password be?

For accounts protected by two-factor authentication, 12–16 random characters are comfortable. For email, banking, or anything that can reset other accounts, use 16 or more. Beyond that, length still adds safety but the practical gain is small compared with simply not reusing passwords.

Is a passphrase weaker than a random password?

Per character, yes — words come from a dictionary, so the entropy per character is lower. But because passphrases are long, they can reach a similar total entropy while being far easier to remember and to type on a phone. Use them for logins you must type by hand; use fully random strings for anything stored in a password manager.

Do I need to change my passwords regularly?

Modern advice has moved away from forced periodic rotation, which mostly produces predictable variations. Change a password when there is a reason: a breach notice, a shared device, or a service you no longer trust. Prioritise unique passwords and two-factor authentication over a rotation schedule.