Password length and randomness
Data breaches are common, and attackers routinely try leaked passwords on other sites. A long, random, unique password for every account helps limit the effect of a leaked password. This generator creates passwords locally in your browser using its cryptographic random number generator. Nothing is sent to a server or stored.
What makes a password strong
Strength comes from unpredictability, measured in bits of entropy. Each additional bit doubles the number of possible values. For a random password, entropy is the length multiplied by log₂ of the number of possible characters. For example, 16 independently chosen characters from a set of 94 give about 105 bits. Both the length and the size of the character set affect the result.
The rating bands in this tool describe estimated entropy, not a guaranteed level of protection. The time estimate assumes 10 billion guesses per second and an average search through half the possible values. Real attacks depend on how the site stores passwords, rate limits and what the attacker already knows. Treat the estimate as a comparison between generated passwords.
Passwords or passphrases?
A passphrase strings random words together, like Maple-Otter-Quartz-Lagoon-Fiddle-Cedar7. It is easier to type and remember than a jumble of symbols, which makes it a good choice for the few passwords you have to enter by hand, such as your password manager's master password or your computer login. The words must be chosen at random, not by you. Each word from this generator's 493-word list adds about 8.9 bits, so eight words give about 72 bits and ten give about 89. Larger lists built for the purpose, such as the EFF's 7,776-word list, give about 12.9 bits per word, so fewer words are needed.
How this generator works
- Randomness comes from
crypto.getRandomValues, the browser's cryptographically secure generator, notMath.random. - Characters are chosen with rejection sampling, so every character is exactly equally likely. The common shortcut of taking a random number modulo the set size slightly favours some characters.
- When several character types are selected, the generator makes sure each one appears at least once, which many sites require. The entropy shown accounts for that rule.
Good habits
- Use a different password for every account, so one breach doesn't unlock the rest.
- Store them in a password manager rather than a document or browser note.
- Turn on two-factor authentication wherever it is offered, preferably with an app or security key.
- Avoid look-alike characters if you will need to read the password aloud or type it from paper.
