Password Generator creates strong, random passwords entirely inside your browser. It uses the Web Crypto API (crypto.getRandomValues) instead of Math.random(), so the password never touches the network and is never predictable from timing or seed leaks.
Pick a length and character classes to generate a password, or edit the result and enter one of your own. The entropy scale and crack-time estimate update with every change. Generated passwords use the exact configured search space; manually entered passwords use a clearly marked estimate based on their detected character classes.
What Actually Makes a Password Strong
Most password advice repeats the same handful of rules. Here is the condensed, non-redundant version:
- Length beats complexity. Adding one more character to a password increases the number of possible passwords by a full factor of the pool size b; adding one more character class only ever adds a few dozen options at most. A 20-character password wins over a 12-character one almost regardless of which character classes you allow.
- Uniqueness matters more than memorability. A password that is reused across accounts turns a single breach into many. Generate a fresh, unrelated password per account instead of variations on a theme.
- Passphrases are a valid strategy. A long sequence of unrelated words can carry as much entropy as a shorter random string with symbols, see the calculation below, and is often easier to type or remember when you must.
- Store, don't memorize. Use a password manager so length and uniqueness stop being a trade-off against your own memory.
- Enable two-factor authentication wherever it is offered. It protects the account even if the password itself is ever exposed through phishing or a server-side breach.
- Never write passwords in plain text, in browser-saved-password stores you don't control, or in shared documents and chat messages.
- Rotate only when there is a reason, such as a confirmed breach notice or shared access that has ended. Rotating a strong, unique password on an arbitrary schedule adds little and mostly causes people to pick weaker, easier-to-type passwords.
The Math Behind the Crack-Time Estimate
The tool's crack-time indicator is not a lookup table, it is computed from the exact settings you chose. Let b be the size of the character pool (digits contribute 10, uppercase and lowercase 26 each, symbols 32, so the full default pool is b = 94) and n the chosen length.
If repeated characters are allowed, the number of possible passwords is bn, which corresponds to an entropy of
\[ H = n \cdot \log_2 b \quad \text{bits.} \]With Exclude Duplicate enabled, each character can only be used once, so the count follows a falling factorial instead:
\[ b \cdot (b-1) \cdot (b-2) \cdots (b-n+1), \qquad H = \sum_{i=0}^{n-1} \log_2(b-i). \]Because every factor in that product is at most b, excluding duplicates can only ever lower the entropy compared to allowing repeats for the same pool and length, never raise it. The difference is small for short passwords and grows for longer ones as the pool gets used up.
For manually entered passwords, the original generation process is unknown. The tool therefore estimates b from the character classes that occur in the text and displays the result as an estimate. This describes the size of a corresponding random search space, not the unpredictability of human choices: dictionary words, dates, repeated fragments, and keyboard patterns can be cracked much faster than that number suggests.
The tool converts the resulting bit count into a crack time by assuming an attacker capable of \(10^{11}\) guesses per second (100 billion per second, a realistic upper bound for offline brute-forcing weakly-hashed data) and dividing the number of possible passwords by that rate. A few concrete results from that formula:
- The default settings (16 characters, all four classes, duplicates excluded) yield about 103 bits of entropy, roughly 3 trillion years to exhaust — about 220 times the age of the universe.
- A 12-character password using only digits, like a PIN-style code, has just under 40 bits of entropy and falls in exactly 10 seconds under the same assumption.
- A 20-character passphrase built from lowercase letters alone already reaches about 94 bits, more entropy than a 12-character password mixing all four classes (roughly 79 bits). Length wins.
Exclude Similar removes the visually ambiguous characters 0/O, 1/l/|, and 2/Z from the pool, shrinking it from 94 to 87 characters. That is a small entropy cost, useful when a password has to be typed or read out loud rather than pasted from a manager.
FAQ
Is it safe to use an online password generator?
It is safe as long as the password is generated locally and never sent anywhere, which is exactly what this tool does: everything happens in your browser via the Web Crypto API, with no network request involved in creating or displaying the password.
Password or passphrase, which is better?
Both are just points on the same entropy scale described above. A password mixes character classes into a shorter string; a passphrase spreads the same or more entropy over more, easier-to-type characters. Use whichever you can type and store reliably at the length your account allows.
If a service is breached, can my hashed password still be cracked?
It depends entirely on how the service hashed it. A fast, unsalted hash makes offline cracking with precomputed rainbow tables or brute force realistic. A slow, salted hash designed for passwords, such as bcrypt, scrypt, or Argon2, makes the same attack orders of magnitude slower per guess. You cannot control which one a service uses, which is exactly why password length and uniqueness are your side of the defense.
How do attackers actually get passwords in practice?
Rarely through brute force against a live login form, that is usually rate-limited. The common paths are phishing pages that simply ask for the password, credential stuffing with combinations leaked in unrelated breaches, and malware that logs keystrokes or reads a browser's saved-password store. A strong, unique, generated password defeats credential stuffing and offline cracking, but not phishing, that is what two-factor authentication is for.
Are password managers safe to rely on?
A reputable password manager with strong end-to-end encryption is safer than the realistic alternative, which is reused or written-down passwords. It concentrates risk into one master password, so that one should be long, unique, and protected with two-factor authentication.
Do quantum computers break these passwords?
Grover's algorithm gives a quantum computer a quadratic speedup against brute-force search, which in practice halves the effective bit strength of a password rather than eliminating it. A password with 103 bits of classical entropy would still correspond to roughly 51-52 bits against such an attack, and no hardware anywhere near that capability exists today.
What do genuinely weak passwords look like?
Short strings, keyboard sequences, and predictable substitutions repeatedly top real-world breach statistics: 123456, password, qwerty, 123456789, and names or dates tied to the account owner. All of them are near the bottom of the entropy scale described above, regardless of how they are formatted.