Password Generator

What Makes a Password Strong?

Password strength comes down to one thing: entropy — how unpredictable the password is to an attacker. The more entropy (measured in bits), the longer it takes to crack. A random 16-character password using uppercase, lowercase, numbers, and symbols has roughly 100 bits of entropy, which would take billions of years to brute-force on modern hardware.

How to Create a Strong Password

Follow these principles and your accounts will be dramatically harder to compromise:

1. Go long. Length beats complexity. A 20-character password of random words is stronger than a short, garbled one. Aim for at least 12 characters; 16+ is ideal.
2. Mix character types. Combine uppercase letters, lowercase letters, numbers, and symbols. Mixing all four types expands the pool from 26 (lowercase only) to about 95 characters — every extra character then adds ~6.6 bits of entropy.
3. Avoid the predictable.Never use names, birthdays, "password123," keyboard patterns (qwerty), or anything found in a dictionary. Attackers try these first.
4. Use a unique password for every account. If one service is breached, attackers will try the same password on your email, banking, and social accounts.
5. Store them in a password manager. Trying to memorize dozens of strong passwords is impossible. Use a reputable manager (Bitwarden, 1Password, KeePass) to store them encrypted.

How Secure Is This Generator?

This tool uses the Web Crypto API (crypto.getRandomValues), which pulls randomness from your operating system's cryptographically secure random number generator. This is the same standard used by banks and security software. It is dramatically more secure than Math.random(), which is predictable and unsafe for passwords.

Even better: the password is generated entirely in your browser and is never transmitted anywhere. There is no server log, no database, and no tracking. Once you copy it, it lives only on your clipboard.

Understanding Password Strength Scores

The strength meter shown above estimates entropy based on your password's length and the size of the character pool used. Here's what each level means:

• Very Weak (<40 bits): Crackable in seconds to minutes. Never use for anything important.
• Weak (40–60 bits): Crackable in hours to days with consumer hardware. Upgrade your length.
• Strong (60–80 bits): Would take years to crack. Suitable for most personal accounts.
• Very Strong (>80 bits): Effectively uncrackable. Use for email, banking, and password manager master passwords.

Should I Memorize or Use a Manager?

For most people, a password manager is the right answer. The only password you need to memorize is the master passwordthat unlocks your manager — make it a long passphrase (4-5 random words) rather than a short complex string. Every other password can be a random 20+ character string generated here, since you'll never need to type it.