How this password generator works
A strong password is one that is hard to guess and hard to crack by brute force. Humans are bad at being random — we lean on names, dates and keyboard patterns — so the safest approach is to let a machine pick every character at random from a known set. This tool does exactly that, using your browser's cryptographically secure random generator rather than the ordinary, predictable kind.
You choose the length and which character sets to draw from: upper-case letters, lower-case letters, numbers and symbols. The generator then picks each character independently and uniformly from the combined set, and guarantees at least one character from every set you turned on. You can also exclude ambiguous characters — the capital O and zero, the lower-case L, the number one and the capital I — which makes a password easier to read aloud or copy by hand at the small cost of a slightly smaller character set.
Strength is reported as entropy in bits: the password length multiplied by the base-2 logarithm of the size of the character set. Each extra bit doubles the number of guesses an attacker needs, so a few more characters matters far more than it looks.
| Length | Character set | Approx. entropy | Est. time to crack* |
|---|---|---|---|
| 8 | Letters + numbers (62) | ~48 bits | Hours to days |
| 12 | All four sets (94) | ~79 bits | Thousands of years |
| 16 | All four sets (94) | ~105 bits | Far beyond practical reach |
| 20 | All four sets (94) | ~131 bits | Far beyond practical reach |
| 4 words | Passphrase (~60-word list) | ~24 bits | Use 5–6 words for more |
*Crack times are rough illustrations assuming an offline attacker making many billions of guesses per second; real-world times vary widely with hardware and how the password is stored. A short built-in wordlist is used here for convenience — long, diceware-style lists of thousands of words give passphrases far higher entropy per word.
Frequently asked questions
- How do I create a strong password?
- Make it long and unpredictable: at least 16 characters mixing upper- and lower-case letters, numbers and symbols, and never reused across sites. Letting a generator pick the characters removes the human patterns that make passwords easy to guess.
- How long should a password be?
- Aim for at least 16 characters. Length is the single biggest factor in crack resistance — each extra character multiplies the possible combinations far more than swapping one character type for another.
- Are these passwords safe or stored anywhere?
- Yes. Every password is generated locally in your browser using your device's secure random generator. Nothing is sent over the network and nothing is saved — copy it into a password manager before you close the tab.
- What is a passphrase?
- A passphrase is a password made of several random words joined together, like river-amber-token-puzzle. It is easier to read and type than a random string while still being long, and with four or more truly random words it offers strong protection.
- Should I use symbols in my password?
- Symbols enlarge the character set and add entropy, so they help. But a longer password usually beats a shorter one with more symbols. Use symbols where a site allows them, and lean on extra length when it does not.
- How is password strength measured?
- In bits of entropy: the length multiplied by the base-2 logarithm of the character-set size. More characters and a bigger set mean more entropy and exponentially more guesses needed to crack it.