Password generator
Made in your browser, from the same cryptographic generator a browser uses for its own keys — and reported in bits of entropy rather than as a colour, because bits are what an attacker has to work through.
By Alex Seote, Built and maintains Rule Calculator
Method checked against NIST SP 800-63B · How we check
Pick at least one character set, and a length of at least four.
Why the strength bar is not the answer
A strength meter looks at the shape of a password: length, mixed case, a digit, a symbol. An attacker does not attack shapes, they work through a search space, and the size of that space is decided by how the password was chosen rather than by what it contains. A generated 16-character password and a human-invented one of the same length are not remotely the same problem.
The figures above split the question by attack speed, because a single “time to crack” hides ten orders of magnitude. The same password that survives centuries of throttled login attempts can fall in hours if a site stored it under a fast hash and lost the database — which is why unique passwords matter more than clever ones.
Questions people actually ask
- What are bits of entropy, and why not a strength meter?
- Entropy counts the guesses an attacker has to make. Each bit doubles that number, so 60 bits is a thousand times harder than 50. For a password generated at random it is exactly the length times the log base two of the character pool — nothing is estimated. A strength meter, by contrast, is a heuristic about patterns, and it will happily call "P@ssw0rd123" strong.
- How long should a password be?
- Long enough that the entropy clears the attack you are worried about, which for an account that could end up in a breached database means comfortably over 70 bits — around 12 characters from a full pool, or 16 to be unbothered by it. The current NIST guidance drops the old composition rules entirely and asks for length instead, because the rules pushed people toward predictable substitutions.
- Is a random string better than a passphrase?
- Not per character — per character a random string wins easily — but that is the wrong comparison. Four words drawn randomly from a 7,776-word list carry about 52 bits and can be typed on a phone; a 12-character random string carries about 78 and cannot be remembered at all. If you are typing it by hand, the passphrase wins. If a manager is typing it, use the longest random string the site accepts.
- Does this send my password anywhere?
- No. It is generated by your browser’s crypto.getRandomValues and never leaves the page — there is no request to make and nothing on our side to log. Reload and it is gone. That is true of any generator that runs client-side, and worth checking before using one that does not say.
- Should I change my passwords regularly?
- No, not on a schedule. Forced rotation was dropped from NIST’s guidance because it makes people choose weaker passwords and increment them predictably. Change one when there is a reason to — a breach, a shared device, a suspicion — and otherwise leave a strong unique password alone.