Secure Password Generator
Generate cryptographically secure passwords and passphrases. 100% client-side — nothing leaves your browser.
Memorable format — ~34 bits of true entropy. Best for low-risk accounts or when paired with two-factor authentication.
What Makes a Password Strong?
Password strength comes down to two things: length and true randomness. A 16-character password using all character types reaches approximately 102 bits of entropy — enough to resist modern brute-force attacks for billions of years.
1. Length Is the Biggest Factor
Each additional character multiplies the total number of possible passwords by the pool size. Going from 8 to 16 characters (83-character pool) raises entropy from 51 bits to 102 bits — doubling the length doubles the bits, but the actual search space grows exponentially (from 251 to 2102 — that's a trillion trillion times larger).
2. Cryptographically Secure Randomness
This tool uses window.crypto.getRandomValues(), the browser's
cryptographically secure random number generator (CSPRNG). Unlike Math.random(),
which is predictable, a CSPRNG produces unpredictable output suitable for security applications.
3. Character Pool Size
More character types mean a larger pool, which means more entropy per character.
This tool uses a 21-symbol set (!@#$%^&*()-_=+[]{}<>?),
giving a combined pool of 83 characters when all types are enabled.
Entropy Reference
| Length | Character Types | Pool | Entropy |
|---|---|---|---|
| 8 | Lowercase only | 26 | 37.6 bits |
| 12 | Lowercase only | 26 | 56.4 bits |
| 8 | Alphanumeric | 62 | 47.6 bits |
| 12 | Alphanumeric | 62 | 71.5 bits |
| 16 | Alphanumeric | 62 | 95.3 bits |
| 12 | All types | 83 | 76.5 bits |
| 16 | All types | 83 | 102.0 bits ✓ |
| 20 | All types | 83 | 127.5 bits |
Crack time assumes an offline attack at 10 billion guesses per second (typical for SHA-256 on a GPU). For bcrypt or Argon2id, actual crack rates are orders of magnitude slower.
Security Standards
NIST SP 800-63B (Digital Identity Guidelines, 2017) recommends: checking passwords against known-breached lists, allowing passphrases of up to 64 characters, and not enforcing periodic rotation or arbitrary complexity rules. For randomly generated passwords, security professionals broadly recommend targeting 80+ bits of entropy for strong protection.
Learn more in our detailed guide: password entropy explained — or explore how hackers crack passwords.
FAQ
What is password entropy?
Password entropy measures unpredictability in bits. It is calculated as length × log₂(pool size). A 16-character password from an 83-character pool has 102 bits of entropy.
How many bits of entropy should a password have?
Security professionals recommend at least 80 bits for strong protection. Passwords above 100 bits are resistant to brute-force attacks even with high-speed hardware.
Is this generator safe?
Yes. Passwords are generated entirely in your browser using
window.crypto.getRandomValues(). Nothing is transmitted to any server.
What is the difference between a password and a passphrase?
A password is a short random string; a passphrase uses multiple random words. Read our full comparison: password vs. passphrase.
What does the crack time estimate mean?
It represents the worst-case time to exhaust all possible passwords at 10 billion guesses per second — a typical offline attack rate against SHA-256 hashes on a modern GPU. Online attacks are far slower due to rate-limiting.
Can I use this tool to create a strong WiFi password?
Yes. WPA2 and WPA3 support passwords from 8 to 63 characters. A 16-character random password from this tool gives 102 bits of entropy, which is far beyond any practical attack. See our guide on strong WiFi password examples.
