Generate secure, random passwords.
All calculations performed locally in your browser. No data sent to server.
Results are for informational purposes. Verify results with other sources.
How password strength is actually measured
Strength is entropy: how many guesses an attacker needs on average. It depends on the size of the character set and the length, and on nothing else — a password is not stronger because it looks complicated to you.
How it works
- Draws each character independently from the set you selected, using the browser's cryptographically secure random source.
- Entropy is length × log₂(alphabet size), measured in bits. Each extra bit doubles the work of a brute-force search.
- Adding a character type widens the alphabet a little; adding length multiplies the search space — which is why length wins.
entropy (bits) = length × log₂(alphabet size) lowercase only (26) → 4.7 bits per character + uppercase (52) → 5.7 bits per character + digits (62) → 5.95 bits per character + symbols (94) → 6.55 bits per character
Worked example
Comparing a 12-character password using every character type against a 16-character lowercase one.
- 12 chars from 94 symbols → 12 × 6.55 = 78.6 bits
- 16 chars from 26 letters → 16 × 4.70 = 75.2 bits
- at 10^12 guesses per second, 2^78.6 ÷ 2 takes ≈ 6,000 years
- the same rate against 2^75.2 ÷ 2 takes ≈ 600 years
The longer, simpler password is within a factor of ten of the shorter, complex one — and is far easier to type. Anything above roughly 75 bits is out of reach of offline brute force with current hardware.
Reading the result
- Entropy only counts if the password was actually generated at random. A human-chosen password containing a word, a name or a date has vastly less entropy than its length suggests, because attackers guess in dictionary order, not alphabetically.
- Substitutions like p@ssw0rd add almost nothing. Cracking tools have applied those rules since the 1990s.
- Reuse defeats strength entirely. A perfect password used on two sites is only as safe as the weaker site's database.
- The practical answer for most people is a password manager generating 16+ random characters per site, so length costs you nothing to remember.
Common questions
- How long should a password be?
- 16 random characters from a mixed alphabet gives about 105 bits, which is beyond brute force by a wide margin. If you must memorise it, use five or six random words instead — a six-word passphrase from a 7,776-word list is about 77 bits.
- Are passphrases really as strong as random strings?
- Yes, if the words are chosen randomly by a tool rather than by you. Six random words beat twelve random characters, and you can actually remember them. Words you pick yourself are not random and do not count.