Password Generator

Password strength is measured in entropy, in bits: the larger the pool of possible combinations, the longer a brute-force attack takes. This generator uses the browser's cryptographic random generator: the draw happens on your device and no password is ever transmitted.

What entropy means

Entropy measures a password's unpredictability, in bits: length × log₂(alphabet size). Twelve characters drawn from the 94 printable characters give about 78 bits; sixteen characters, about 104 bits.

In practice, 70–80 bits resist current attacks, provided the password is unique per service. Length beats complexity: adding a character raises entropy more than swapping a letter for a symbol.

Why length wins over complexity

Rules forcing uppercase, digits and symbols often produce predictable patterns like Summer2024!, which cracking tools try first. A long random draw, even without exotic characters, resists better. National cybersecurity agencies now favour length and true randomness.

• 16 random characters cover the vast majority of personal uses.
• 20 or more for the primary mailbox, banking and the password manager itself.
• One password per service, kept in a manager rather than memorised.
• Two-factor authentication through an authenticator app or hardware key, preferably over SMS.

Periodic changes are no longer recommended

Guidance has shifted: rotating every 90 days pushes people toward weak, predictable variants. Change a password after a breach or a doubt, not on a calendar. Checking known-breach databases and using a manager bring far more safety.

Passwords generated here never leave your browser: no network request, no storage. Copy the result into your manager, then close the page.

FAQ

• What password length should I choose?

  16 random characters suit most uses. For critical accounts — primary mailbox, banking, the password manager itself — aim for 20 or more.

• Is a password manager safer than memory?

  Yes, in practice. It enables one long, unique password per service, eliminating reuse — the real dominant risk. Human memory breeds predictable variants.

• Should I change passwords regularly?

  Systematic rotation every few months is now discouraged: it breeds weak variants. Change a password after a breach or a doubt.

• Is two-factor authentication essential?

  It sharply reduces the risk of compromise even if the password leaks. Prefer an authenticator app or hardware key over SMS.