Password Generator

Strength meters lie, entropy does not

Every password field with a green bar under it is running a heuristic: length plus a bonus for a capital letter plus a penalty for password. Those heuristics disagree with each other and with reality. A ten-character password built from a generator is far stronger than a fourteen-character one a person invented, because people do not produce randomness — they produce patterns that guessing dictionaries already model.

The honest measure is entropy: how many equally likely passwords the generator could have produced. For a string of n characters drawn uniformly from a pool of p symbols, that is pn possibilities, or n × log2(p) bits. Everything else — the estimated cracking time — is derived from that number and an assumption about how fast an attacker can guess.

Character pool	Symbols	Bits per character
Lowercase only	26	4.70
Lower + upper	52	5.70
+ digits	62	5.95
+ 10 common symbols	72	6.17
Full printable ASCII	94	6.55

Notice how little the symbol set buys you. Going from lowercase-only to the full printable set adds under two bits per character, while adding four characters adds about twenty-five bits. Length beats complexity, every time.

What "time to crack" actually assumes

The estimate below is arithmetic on the entropy figure, and the assumption is the whole story. Three scenarios differ by roughly ten orders of magnitude:

Scenario	Assumed guess rate	What it models
Online, rate-limited	103 / s	A login form with throttling. Almost nothing brute-forces here; attackers use credential stuffing instead.
Offline, fast hash	1010 / s	A leaked database hashed with MD5 or SHA-1 on commodity GPUs.
Offline, slow hash	104 / s	The same leak, but hashed with bcrypt, scrypt or Argon2 as it should have been.

The practical reading: against an online service, almost any generated password is uncrackable, and your real risk is reuse, not guessing. Against an offline attacker with a breached fast-hashed database, you need roughly 80 bits or more to be comfortable. That is about 14 random characters from the 72-symbol pool, or 10 words from the 256-word list below.

Why generate it here rather than on a website

A password generator is a small amount of code that needs one thing: a source of randomness. Browsers have had one since 2011 in crypto.getRandomValues(), backed by the operating system's entropy pool. There is no reason for the generation to happen on someone else's machine.

This page uses crypto.getRandomValues() and draws with rejection sampling rather than a plain modulo. Taking a random 32-bit value modulo a pool size that does not divide 2³² evenly makes some characters slightly more likely than others — a small bias, but a real one, and it is free to avoid.

Frequently asked questions

Is a passphrase really as strong as a random string?

Per word, it is stronger, because the pool is larger — 8 bits per word from this 256-word list versus about 6.2 bits per character. The catch is that the list is public, so the attacker knows it. Never invent your own phrase: only use words drawn at random from a known list, which is what this generator does.

Why does the site require one character from each class?

It does not require it; it is an option, on by default, because many services still impose composition rules. Be aware that enforcing it removes a small number of possible passwords from the pool, so the true entropy is a fraction of a bit below the figure shown. The effect is negligible at these lengths.

Should I write generated passwords down?

If you are not using a password manager, yes — on paper, kept where you keep other valuables. The threat model for most people is remote attackers, not someone searching their desk. What you must never do is reuse one password across sites, because that is the failure mode that actually causes account takeover.

How often should I rotate passwords?

Rarely. Forced rotation is now understood to do more harm than good — it pushes people towards predictable variations like appending a digit. Rotate on evidence of a breach, not on a schedule.