Password Generator
Build a password that is genuinely hard to guess. Choose the length and character mix, and the generator does the rest using your browser's cryptographic randomness.
Anything from 16 characters up is comfortably out of reach.
How to pick a password worth using
Length beats cleverness. A 20-character password drawn from a mixed pool has far more entropy than a short one with a symbol bolted on the end, and it is no harder to store in a password manager.
The strength meter here reports real entropy: the size of the character pool raised to the length of the password, expressed in bits. Under 56 bits is worth improving, and 78 bits or more is comfortable for accounts that matter.
How long does a password actually hold?
The table assumes the worst realistic case. An attacker has stolen a database, is working offline with no rate limit, and is guessing at a hundred billion attempts per second, which is roughly what a rack of modern graphics cards manages against a fast hash like MD5 or SHA-1. Against a deliberately slow hash such as bcrypt or Argon2 every figure below becomes vastly larger.
The numbers use the full 85-character pool this generator produces with every character type switched on, and show the average time to a hit rather than the time to try everything.
| Length | Possible passwords | Average time to crack |
|---|---|---|
| 8 | 2.7 × 1015 | About 4 hours |
| 10 | 2.0 × 1019 | About 3 years |
| 12 | 1.4 × 1023 | About 22,000 years |
| 16 | 7.4 × 1030 | About a trillion years |
| 20 | 3.9 × 1038 | Longer than any figure worth writing down |
The jump from 8 to 12 characters is the one that changes the outcome. Everything past 16 is theatre, which is exactly why 16 to 20 is a sensible place to sit: comfortably out of reach without pretending the extra characters are doing work.
Where passwords are actually lost
Almost nobody is brute forced. Passwords leak because the same one was reused on a site that got breached, because it was typed into a convincing fake login page, or because it was sitting in a note on a shared computer. A long random password fixes only the first of those, and only if it is different everywhere.
So the habit that matters is not complexity, it is uniqueness. Generate a fresh password per account, keep them in a password manager so you never have to recall one, and switch on two-factor authentication wherever it is offered. That combination beats any amount of cleverness in a single password.
Are these passwords safe to use?
Yes. They are generated on your device with the Web Crypto API and never transmitted. Refresh the page and the password is gone for good, so save it in a password manager before you navigate away.
What does “exclude look-alikes” do?
It removes characters that are easy to confuse when read aloud or typed from a screenshot: capital I, lowercase l, the digit 1, O and 0 among them. Useful for a password you have to dictate or retype by hand, at the cost of a slightly smaller pool.
How long should my password be?
Sixteen characters is a sensible floor for everyday accounts. For a password manager master key or anything protecting money or identity, use 24 or more. Length costs you nothing when software does the typing.
Should I change my passwords on a schedule?
No. Forced rotation pushes people towards small predictable edits, turning one good password into a series of weak ones. Current guidance from NIST is to change a password when there is reason to think it has been exposed, and otherwise leave a strong unique password alone.
Are passphrases better than random strings?
They solve a different problem. Four or five genuinely random words are strong and possible to memorise, which matters for the handful of passwords you must type yourself. A random string packs more entropy per character and is the better choice for everything a password manager fills in for you.
Why does the meter ignore my clever substitutions?
Because attackers do not. Swapping a for @ and o for 0 is the first thing every cracking tool tries, so a dictionary word dressed up that way is barely harder than the word itself. Entropy comes from being unpredictable, not from looking complicated.