🔑 Password Generator
A password generator with a passphrase mode: six random words is 77.5 bits, the same as a 12-character password. Runs in your browser; nothing is uploaded.
What Password Generator Does
Password strength is not about exotic characters. It is about entropy — the number of equally likely possibilities an attacker must search. A password drawn at random from a known alphabet has entropy you can calculate exactly, which is why randomly generated passwords are the only kind whose strength can be stated with confidence.
Human-chosen passwords fail because they are not drawn uniformly. "P@ssw0rd!" satisfies every complexity rule most systems impose and appears in every cracking dictionary, because the substitutions people make are the same substitutions everyone makes. An attacker does not guess character by character; they guess pattern by pattern.
This generator uses your browser's crypto.getRandomValues(), a cryptographically secure source, and never transmits the result. Nothing you generate leaves your device — there is no network call in the code that produces it.
It will also build a passphrase instead, drawn word by word from the Electronic Frontier Foundation's 7,776-word list. That is the "correct horse battery staple" construction, and it exists here because a password you cannot remember is one you will write down or reuse. Each word is worth 12.9248 bits, so five words is 64.6 bits and seven is 90.5 — strength you can state exactly, in something you can say out loud.
One number on this page is deliberately lower than the one competing generators print. If you ask for at least one character of each selected type, you have ruled out every password that happens to miss a type, and a smaller set of possibilities is less entropy, not more. The figure shown is the size of the set the tool actually draws from.
How to Use Password Generator
- Choose random characters or a passphrase built from whole words
- Set the length in characters, or the number of words
- Read the strength in bits — the figure accounts for any rules you switched on
- Copy the result; it was generated in your browser and never sent anywhere
Formula Used by Password Generator
Password entropy
E = L × log₂(R)
- E
- Entropy in bits — each additional bit doubles the search space
- L
- Password length in characters
- R
- Size of the character set drawn from
Worked example
A 16-character password using this tool's four sets — 26 lowercase, 26 uppercase, 10 digits and 26 symbols (R = 88).
- log₂(88) = 6.4594 bits per character
- E = 16 × 6.4594 = 103.35 bits
- Search space: 2^103.35 ≈ 1.3 × 10^31 possibilities
Result: 103.35 bits — but only if every one of those possibilities can actually be produced. See the next block.
What "at least one of each type" costs you
valid = Σ over subsets S of the classes (−1)^|S| × (R − size(S))^L
- classes
- The character types you ticked — lowercase, uppercase, digits, symbols
- valid
- How many length-L passwords contain at least one character from every ticked type
- (−1)^|S|
- Inclusion-exclusion: subtract the passwords missing one type, add back those missing two, and so on
Worked example
16 characters over all four sets (R = 88), requiring one of each
- Without the rule: 88^16, which is 103.35 bits
- Subtract the strings missing lowercase, missing uppercase, missing digits, missing symbols; add back the overlaps
- log₂(valid) = 103.11 bits
Result: The rule costs 0.24 bits at length 16 — negligible. At length 8 it costs 1.05 bits, because with only eight slots the requirement rules out a much larger share. Either way the honest figure is the smaller one, and it is the one this tool shows.
Passphrase entropy
E = k × log₂(n)
- k
- Number of words drawn
- n
- Size of the list they are drawn from — 7,776 for EFF's long list
Worked example
Six words from the EFF long list
- log₂(7776) = 12.9248 bits per word
- E = 6 × 12.9248 = 77.5 bits
Result: 77.5 bits. Note what is NOT in that sum: capitalizing each word, or joining with hyphens rather than spaces, adds nothing, because an attacker who knows you used this method knows the rule too. Only the word choices are secret.
Time to crack (offline attack)
t = 2^(E−1) ÷ guesses_per_second
- 2^(E−1)
- Expected guesses to find it — on average, half the space
- guesses_per_second
- Attacker throughput, which depends entirely on how the password was hashed
Entropy by Length and Character Set
Length buys more than complexity does. A 20-character lowercase-only password beats a 12-character password using every symbol on the keyboard.
| Character set | Bits per char | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|
| Digits only (10) | 3.32 | 27 bits | 40 bits | 53 bits | 66 bits |
| Lowercase (26) | 4.70 | 38 bits | 56 bits | 75 bits | 94 bits |
| Alphanumeric (62) | 5.95 | 48 bits | 71 bits | 95 bits | 119 bits |
| Full ASCII (95) | 6.57 | 53 bits | 79 bits | 105 bits | 131 bits |
Passphrases — words instead of characters
Drawn from EFF's 7,776-word list at 12.9248 bits per word. The equivalence in the third column is almost exactly two: one word from this list is worth 2.0009 random characters from the 88-character set above, so six words and a twelve-character password are the same strength. The difference is that you can remember one of them — and that you type about four times as much (six words average 47 characters with spaces).
| Words | Entropy | Same as this many random characters | Verdict |
|---|---|---|---|
| 3 | 38.8 bits | 6 | Too weak — do not |
| 4 | 51.7 bits | 8 | Weak against offline attack |
| 5 | 64.6 bits | 10 | Adequate where login attempts are rate-limited |
| 6 | 77.5 bits | 12 | The sensible default |
| 7 | 90.5 bits | 14 | Strong |
| 8 | 103.4 bits | 16 | Beyond brute force |
Source: EFF — Deep Dive: New Wordlists for Random Passphrases
What the current NIST guideline actually requires
From SP 800-63B revision 4, which superseded the widely quoted SP 800-63B on 1 August 2025. SHALL is mandatory; SHOULD is recommended. Several of these are the opposite of what most sites still enforce, and the length rule changed: the old document set the floor at 8 characters.
| Rule | Strength |
|---|---|
| Minimum 15 characters when the password is the only factor | SHALL |
| Minimum 8 characters when it is one factor of several | SHALL |
| Permit at least 64 characters | SHOULD |
| Accept all printing ASCII characters and the space | SHOULD |
| Accept Unicode, counting each code point as one character | SHOULD |
| Impose composition rules such as "must mix character types" | SHALL NOT |
| Require periodic password changes without evidence of compromise | SHALL NOT |
| Store a password hint reachable by anyone not logged in | SHALL NOT |
| Use security questions such as "your first pet" | SHALL NOT |
| Screen new passwords against a blocklist of breached and common values | SHALL |
What Entropy Actually Buys You
Assuming an offline attack at 100 billion guesses per second — realistic for a fast hash like unsalted SHA-1 on GPU hardware.
| Entropy | Average time to crack | Verdict |
|---|---|---|
| < 40 bits | Under a minute | Broken on sight |
| 50 bits | About 1.6 hours | Inadequate |
| 60 bits | About 2 months | Weak for anything valuable |
| 80 bits | About 192,000 years | Adequate for most accounts |
| 100 bits | About 2 × 10^11 years | Beyond brute force |
| 128 bits | Longer than the universe has existed | Cryptographic strength |
How to Read Your Result
The hash matters more than the password
The same password is broken in seconds or holds for centuries depending on how the service stored it. Against unsalted MD5 an attacker manages tens of billions of guesses per second; against bcrypt at a sensible work factor, a few thousand. You cannot control this, which is the strongest argument for length: it is the only variable on your side of the equation.
Why NIST dropped complexity rules — and raised the length floor to 15
NIST explicitly forbids mandatory composition rules and routine expiry: verifiers SHALL NOT impose "other composition rules (e.g., requiring mixtures of different character types)" and SHALL NOT require periodic changes without evidence of compromise. Both push people toward predictable patterns — a capital at the front, a digit and a symbol at the end, incremented each quarter. NIST's own appendix makes the point bluntly, noting that users are very likely to choose "Password1" when required to add an uppercase letter and a digit. What changed recently, and what most password pages have not caught up with, is the length rule: revision 4 of SP 800-63B raised the minimum for a password used as the only authentication factor from 8 characters to 15. If you are picking a number from this page, pick one at least that long.
Can you trust a password generator you found online?
It is the right question, and it has a checkable answer rather than a reassuring one. Three things decide it. First, where the randomness comes from: this one calls crypto.getRandomValues(), the browser's cryptographically secure generator, not Math.random(), which is fast, predictable from its own previous outputs, and unsuitable for anything secret. Second, whether the password is generated on your device or on a server: a server-side generator has, by construction, seen your password, and you have only its word about what it did next. This page ships the generator as JavaScript that runs in your browser — you can open the network tab, generate a hundred passwords, and watch nothing get sent. Third, whether the page is doing anything else with what it produced. The honest position on all three is that you should not have to take anyone's word for it: the site is a static export, the code is in your browser, and the test takes ten seconds. If you would rather not extend that trust to any web page, a password manager's built-in generator is the better habit anyway, because it stores the result in the same motion.
The passphrase question — "correct horse battery staple", fifteen years on
The xkcd comic that popularized passphrases is arithmetically sound and widely misapplied. Its point is that four words drawn AT RANDOM beat an obfuscated single word, and the emphasis belongs on "at random". A phrase you composed yourself is not four random words; it is a sentence, and the space of sentences a person actually writes is far smaller than 7,776^4. The strength figures on this page hold only because the words come from crypto.getRandomValues() rather than from you. Worth knowing too: the comic scores "correct horse battery staple" at 44 bits, from a 2,048-word list at 11 bits a word, and EFF's longer list moves four words to 51.7 bits. Either way four is not the number to use — six is.
Two tables on this page assume different attackers, and the difference is the whole argument
The crack-time table above assumes 100 billion guesses per second, which is an offline attack: the attacker has stolen the password database and is grinding it on their own hardware. The xkcd comic assumes 1,000 guesses per second and says so explicitly — "plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about." Both are right about different situations, and the gap between them is a factor of a hundred million. At the comic's rate its 28-bit example survives three days; at the offline rate it survives about three thousandths of a second. This is why one number cannot answer "is my password strong enough" — the answer depends on a variable you do not control, which is how the site you are signing up for stored it. Length is the part you do control.
Reuse is the real risk
Credential stuffing does not crack anything. It takes username and password pairs from one breach and replays them against other sites, which works because most people reuse. A 128-bit password used on two sites is exactly as strong as the weaker site's security. Unique passwords per site matter more than the strength of any one of them.
Limitations & Accuracy Notes
- Entropy describes a randomly generated password only. If you modify the output to make it memorable, the calculation no longer applies — the entropy of a password you chose is unknown and almost always far lower than it appears.
- Crack-time estimates are order-of-magnitude, not predictions. They depend on the hashing algorithm, work factor, salting, and the attacker's hardware budget, none of which you can observe from outside.
- A strong password does not protect an account against phishing, malware, session hijacking or a server-side breach. Multi-factor authentication addresses threats that password strength cannot.
- This tool generates passwords locally and does not store them. You still need somewhere to keep them — a password manager is the practical answer, since nobody memorizes dozens of 16-character random strings.
- The passphrase mode is only as strong as the list it draws from, and that list is public. That is deliberate and it is how the arithmetic works: an attacker is assumed to know the method and the wordlist, and to be guessing which 7,776^k combination you got. A secret wordlist would not add the security it appears to.
- The bits figure describes the password at the moment it is generated. It says nothing about what happens next — typing it into a phishing page, or a service storing it in plain text, ends the discussion regardless of its entropy.
- The "no look-alike characters" option lowers entropy, because it draws from a smaller set. The figure shown accounts for it; the trade is fewer transcription errors for a bit or two of strength, which is usually worth it for something you will read aloud or copy off a screen.
Frequently Asked Questions
How long should my password be?
Can I get a password I can actually remember?
Is this password generator safe? Can I trust it?
Why does the strength drop when I tick "at least one of each type"?
Do symbols make a password stronger than length does?
Is the password really random?
Is the generated password sent anywhere?
How long should a password be?
What if I need to remember it?
Should I avoid ambiguous characters like l, 1, I and O?
Are the forced-complexity rules actually useful?
Can I reuse a generated password across sites?
References & Further Reading
- NIST SP 800-63B-4 §3.1.1.2 — Password Verifiers — Revision 4, which superseded SP 800-63B on 1 August 2025. Source of the 15-character single-factor minimum, the 64-character maximum, and the SHALL NOT clauses on composition rules, periodic expiry, hints and security questions
- EFF — Deep Dive: New Wordlists for Random Passphrases — The 7,776-word long list this tool draws passphrases from, published by the Electronic Frontier Foundation under Creative Commons Attribution. Also the source of the short-list comparison — eight short-list words beat six long-list ones
- xkcd 936 — Password Strength — Where "correct horse battery staple" comes from. Its 44 bits assume a 2,048-word list at 11 bits per word, and its crack times assume 1,000 guesses per second against a remote service, not an offline attack
- Have I Been Pwned — Pwned Passwords — The breached-password corpus NIST requires verifiers to screen new passwords against