Password Generator

Why Your Passwords Probably Are Not Strong Enough

Most people underestimate how fast modern computers can guess passwords. A GPU cluster can attempt 10 billion guesses per second against a plaintext or weakly-hashed password database. An 8-character password using only letters and numbers offers about 41 bits of entropy — crackable in under two hours. Adding symbols and increasing length to 12 characters jumps to 79 bits — hundreds of years of cracking time. The difference between weak and strong is just a few more characters.

This password generator uses the browser's built-in cryptographic random number generator (crypto.getRandomValues) to produce passwords with genuine randomness — not the weaker Math.random() function used by many sites. A rejection-sampling algorithm eliminates modulo bias, so every character in the pool is equally likely to appear.

Passphrases — Strong Passwords You Can Actually Remember

A passphrase is a sequence of random words: "Coral-Tribe-Wafer-Snack-Pilot." It is longer than a typical password, making it very hard to crack, yet memorable because words are meaningful to humans. The passphrase generator uses the EFF Short Wordlist, a curated set of 1,296 common English words chosen for memorability and clarity.

Five words from this list yields 51.7 bits of entropy. Six words reach 62 bits — stronger than most 10-character random passwords. Add a number suffix and you exceed 68 bits. Eight words gives 82.7 bits, putting your passphrase in the Very Strong tier with billions of years of estimated crack time even for well-funded attackers.

Understanding the Strength Meter

The strength meter shows entropy in bits — a direct mathematical measure of randomness. More bits means exponentially more guesses required. The formula is simple: H = L × log₂(R), where L is the password length and R is the size of the character pool. A 16-character password using all four character classes has a pool of 94 characters: 16 × log₂(94) = 16 × 6.555 = 104.9 bits of entropy. That requires roughly 10²¹ guesses — billions of years at 10 billion guesses per second.

The meter assumes a brute-force attack. Real-world security also depends on your service's hashing algorithm: bcrypt and Argon2 slow attackers dramatically; MD5 does not. Always prefer services that store passwords with modern, slow hashing functions.

Character Classes and Pool Sizes Explained

Lowercase letters alone give a pool of 26. Add uppercase and you reach 52. Add digits for 62. Include symbols and the pool grows to 94 printable ASCII characters. Each additional character class significantly increases the entropy per character. The "exclude ambiguous" option removes O, 0, l, 1, and I — reducing the pool slightly but preventing transcription errors when you must type a password by hand.

The symbol set defaults to 22 common keyboard symbols safe for most password fields: ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : ? /. These are broadly accepted across websites and apps without causing parsing or escaping issues.