What makes a password strong
A password is strong when an attacker who tries guesses as fast as possible still cannot reach it in a useful amount of time. That depends on two things only: how many characters it has, and how many different characters each position could be. Clever substitutions like P@ssw0rd add almost nothing, because cracking tools try them first.
This generator picks every character with the browser's cryptographically secure random number generator and shows the strength as bits of entropy, the standard way to measure how many guesses a random password takes. Nothing is sent over the network.
How to use it
- Choose Password for random characters, or Passphrase for words joined by a separator.
- For a password, set the length with the slider (4 to 128) and choose the character sets: lowercase, uppercase, digits and symbols.
- Look-alike characters such as I, l, 1, O and 0 are left out by default so the result is easy to read and type. Turn on Il1O0 to keep them for the largest possible alphabet.
- Generate up to 10 results at once, copy the one you want, and save it straight into a password manager.
Example: the default settings, measured
Length 20, a-z A-Z 0-9 !@#, look-alike characters left out
78-character alphabet, 125.7 bits, Strong
Each character is one pick out of 78, which is log2(78) or about 6.3 bits. Twenty picks give about 125.7 bits, beyond the reach of any offline guessing attack.
Reading the entropy number
Entropy in bits is length × log2(alphabet size). Every extra bit doubles the number of guesses needed. If a leaked site stored passwords with a fast hash, 40 bits falls to one modern graphics card in minutes. At 64 bits it takes years of dedicated hardware, and at 96 bits or more the cost is out of reach for anyone. The meter on this page calls under 40 bits Weak, under 64 Fair, under 96 Good, and anything above Strong.
Length beats complexity. Adding four characters to a 12-character password gains more than adding symbols to it, and it is easier to type on a phone.
About passphrase mode
A passphrase is easier to remember and to type by hand, which helps for a password manager's master password or a disk-encryption key. Its strength comes from the number of words and the size of the word list. This page's list is short, 55 words, so each word adds only about 5.8 bits, and the meter shows that real figure. Use eight or more words, or choose Password mode, when the phrase protects something valuable.
Habits that matter more than the generator
Never reuse a password across sites: when one site leaks, attackers try the same email and password everywhere else. Store passwords in a password manager rather than a note or a spreadsheet, and turn on two-factor authentication where it is offered. A strong unique password plus a second factor stops almost every account takeover.
Questions
Is it safe to generate a password on a website?
It is safe when the page does the work locally and sends nothing. This tool runs entirely in your browser with WebCrypto randomness; you can disconnect from the internet and it keeps working.
How long should my password be?
For accounts protected by a password manager, 16 to 20 random characters is plenty. For anything you must type often, a long passphrase is more practical.
Why do some sites reject the symbols?
Some old systems only accept certain characters. Turn off !@# and add a few characters of length to make up the difference.
Does the tool remember what it generated?
No. Results exist only on the page until you close or regenerate it.