Password Generator

What makes a password strong

Strength comes from entropy — the number of possibilities an attacker must search. Entropy depends on how long the password is and how large the character set it was drawn from, and length matters far more than complexity.

Length beats complexity

Adding one character to a password multiplies the search space by the size of the character set. Adding symbols only increases the per-character value from about 5.95 bits to 6.55.

Notice that a 20-character all-lowercase password is far stronger than a 12-character one using every symbol on the keyboard. This is why modern guidance — including NIST's — favours long passphrases over short strings of punctuation, and explicitly discourages mandatory complexity rules, which push people toward predictable substitutions like P@ssw0rd!.

How long is enough

• Below 50 bits — breakable quickly by a determined attacker with modern hardware.
• 60-80 bits — adequate for most accounts when combined with rate limiting.
• 80-100 bits — strong; appropriate for email, banking and anything that gates other accounts.
• Above 100 bits — effectively unbreakable by brute force with any foreseeable technology.

A practical baseline is 16 random characters for important accounts and 12 as an absolute minimum. Where a passphrase is easier to handle, four to six random words drawn from a large dictionary provide comparable strength — but the words must be chosen randomly, not by you, since human-chosen words cluster heavily.

What actually breaks passwords

Brute force is rarely how accounts are compromised. The realistic threats are:

• Credential stuffing. Attackers take username and password pairs from one breach and try them everywhere else. This is why reuse is the single most dangerous habit — a strong password reused across ten sites is only as safe as the weakest of those ten.
• Phishing. No amount of entropy helps if you type the password into a convincing fake login page.
• Dictionary and rule-based attacks. Cracking tools apply the substitutions people actually use, so Summer2026! falls almost instantly despite meeting most complexity requirements.
• Breach of the site itself. Entirely outside your control, which is why unique passwords per site limit the blast radius.

Use a password manager

Generating strong passwords is only useful if you can have a different one everywhere, which nobody can do from memory. A password manager stores them, fills them in, and — importantly — will not autofill on a lookalike phishing domain, which makes it a defence against phishing as well as a convenience.

The pattern that works: one long, memorable passphrase for the manager itself, random generated passwords for everything else, and two-factor authentication on the accounts that matter. An app-based authenticator or a hardware key is meaningfully stronger than SMS, which is vulnerable to SIM swapping.

Generated in your browser

These passwords are generated locally using crypto.getRandomValues(), the browser's cryptographically secure random source. Nothing is transmitted, logged or stored — you can verify this in your browser's Network tab. This distinction matters: a generator that produced passwords on a server would mean your password had travelled across a network and existed in someone else's memory before you ever used it.

Generators built on Math.random() are not suitable for passwords. That function is fast but predictable, and its output can be reconstructed from a handful of observed values.

Frequently asked questions