Password Generator with Real Entropy
Random password, word-based passphrase, PIN or pronounceable. Everything is generated in your browser with real cryptography, and strength is measured in bits — not with a colored bar.
2,048-word English list (BIP-39 standard): exactly 11 bits per word.
A PIN offers little on its own (19.9 bits at 6 digits): it works where the system locks after a few attempts.
Alternating consonant-vowel syllables, easy to read aloud. Less entropy per letter — the meter reflects that honestly.
Average time to crack
- Online, rate-limited 100 guesses/s
- —
- Offline, slow hash 10⁴ guesses/s (bcrypt)
- —
- Offline, fast hash 10¹⁰ guesses/s (one GPU)
- —
- GPU cluster 10¹⁴ guesses/s
- —
Four scenarios because “how long” depends on the attacker: the extremes differ by 12 orders of magnitude. Nobody can give you one honest number.
Nothing leaves your browser. Generation runs on crypto.getRandomValues on your device. No accounts, no tool cookies, no requests — verify it in the Network tab of your dev tools.
What actually makes a password strong
A password is strong when the number of possible combinations is enormous and every one of them is equally likely. That's the whole story. It isn't made strong by "having a symbol", by swapping a for @, or by creativity — it's made strong by randomness, and randomness is measured in bits of entropy.
The math is short: with a 76-character set (lowercase, uppercase, digits and symbols), each position contributes log₂(76) ≈ 6.25 bits. Eight lowercase letters give 37.6 bits; twelve full-set characters give 75; sixteen give 100. Each additional bit doubles the attacker's work — between 37.6 and 100 bits lies not "twice as safe" but 2⁶² times more work.
The current technical reference, NIST SP 800-63B, is explicit about something most signup forms still ignore: length matters more than composition rules, and requiring "at least one symbol and one uppercase letter" produces predictable patterns (capital first, "1!" last) that cracking tools try first.
Is a 12-character password enough? Run the numbers
"Password generator, 12 characters" is one of the most common requests — and it's the wrong question, because 12 characters can mean a 20-fold difference in security depending on the character set:
| Recipe | Online 10² g/s | Slow hash 10⁴ g/s | One GPU 10¹⁰ g/s | Cluster 10¹⁴ g/s |
|---|---|---|---|---|
| 8 lowercase · 37.6 bits | 33 years | 121 days | 10 seconds | under 1 second |
| 12 lowercase · 56 bits | 10⁷ years | 114,168 years | 42 days | 6 minutes |
| 12 full-set · 75 bits | 10¹² years | 10¹⁰ years | 59,857 years | 6 years |
| 5 words · 55 bits | 10⁶ years | 57,084 years | 21 days | 3 minutes |
| 7 words · 77 bits | 10¹³ years | 10¹¹ years | 239,428 years | 24 years |
| 16 full-set · 100 bits | 10²⁰ years | 10¹⁸ years | 10¹² years | 10⁸ years |
So: a 12-character password from the full character set (75 bits) is a sound choice for ordinary accounts, and 16 characters (100 bits) removes the question entirely — if a password manager is doing the remembering, longer costs you nothing. Note also how the five-word passphrase that survives millennia of online guessing falls in 3 minutes to a GPU cluster — for a password manager's master password, use six or seven words.
Every cell is 2^(bits−1) ÷ speed — the average time, since on average the attacker succeeds halfway through the keyspace. You can recompute any cell with a calculator; that's the difference between a number and a colored bar. When a tool shows you a crack time without stating its assumed guessing speed, distrust the whole figure.
Passphrases, with the math in plain sight
A passphrase swaps random characters for random words: "cactus-quote-avoid-useless-length" is easier to memorize and type than "fT9#kQ2v", and its strength is just as cleanly computable: the list has 2,048 words, so each word contributes exactly 11 bits (2¹¹ = 2,048). Five words: 55 bits. Seven: 77.
The method goes back to Arnold Reinhold's Diceware (1995) — choosing words by rolling physical dice. The digital version replaces dice with the browser's cryptographic generator, and the golden rule survives: the words are chosen by chance, never by you. A made-up phrase that "looks random" ("myDogRex2024") doesn't have 44 bits; it has the very few bits of phrases a human would invent, and attack dictionaries are full of them.
One detail almost no password generator mentions: the "memorable password" modes of the big password managers use English wordlists even on their Spanish and Portuguese pages — a phrase you can't parse loses the very thing that made it useful. This site serves a native BIP-39 list per language: English here, Spanish and Portuguese on their respective versions of this page.
Generation happens in your browser — and you can verify it
Generating passwords on someone else's website demands an act of faith — unless you can audit it. Here the check is within anyone's reach: open dev tools (F12), switch to the Network tab, generate passwords: no request appears. Or more drastic: load the page, disconnect from the internet, keep generating. This is a static site with no application server — there is nowhere to send your password and no database to store it.
The other half of technical honesty is where the randomness comes from. This generator uses crypto.getRandomValues, the browser's cryptographic generator fed by operating-system entropy. Never Math.random, which is designed to be fast, not unpredictable: its internal state can be reconstructed from a handful of outputs.
And a finer detail that gives careless password generators away: mapping a random 32-bit number onto "one character out of 76" with the division remainder (value % 76) introduces modulo bias — since 2³² isn't divisible by 76, the first characters of the set come up slightly more often. It's a small bias, but a needless one: this engine uses rejection sampling — discard the final non-divisible band and draw again — which removes the bias entirely. Our test suite verifies that property on every build.
Four myths that refuse to die
"12 characters means it's safe"
Twelve characters of which set? Twelve lowercase letters are 56 bits — a GPU rig combs through that in days. Twelve full-set characters are 75 bits — centuries even against fast hashing. Length alone says nothing; bits compare like with like, which is why this page's meter shows bits, not a character count.
"Change it every three months"
A retired practice. NIST has advised against forced rotation since 2017: it produces "Winter2025" → "Spring2026", variants an attacker tries first. Change a password when there's evidence of a leak, not on a calendar.
"Swapping letters for symbols strengthens it"
"p@ssw0rd" sits in every attack dictionary with its substitutions included: cracking tools apply those mutations automatically. Strength comes from randomness, not disguise.
"The bar says Strong, so it's strong"
Three-color meters hide their assumptions: almost none declares the attack speed it calculates with, and some well-known ones quietly assume fast-hash speeds — so the same password reads "cracked in minutes" on one site and "thousands of years" on another. A crack time shown without its assumed guessing speed deserves no trust.
What to do with the password once it exists
A good password generator solves half the problem; the other half is a different password for every service, and with dozens of accounts only a password manager sustains that. Any of the well-known ones will do — this page sells none of them, so the advice carries no commission. The robust combination: a memorized passphrase as the master key + random 16-character passwords stored in the manager for everything else.
Two complementary habits: turn on two-factor authentication wherever it exists (it turns a leaked password into half a problem), and if pasting a password into a form fails "for no reason", check it isn't dragging an invisible character along — our invisible character detector spots it instantly. For text that legacy systems reject over accents, there's remove accents.
Frequently asked questions
Is it safe to generate a password on a website?
Is a 12-character password strong enough?
Which is better: a random password or a passphrase?
Why measure strength in bits instead of weak/strong labels?
How often should I change my password?
Where should I store the passwords I generate?
Related tools
Invisible Character
Generate and detect invisible Unicode characters.
Nickname Generator
Decorated names with symbols for games and social apps.
Character Counter
Count characters with and without spaces.
Base64 Encoder
Encode and decode Base64 with correct UTF-8.
Remove Accents
Normalize accented text for legacy systems.
Clean Text
Strip invisible characters and leftover formatting.