Random passwords, Diceware passphrases and PINs from your browser's cryptographic random generator, with the exact entropy of every result, bulk generation, and a strength checker that names the patterns that make a typed password guessable.
| Attack scenario | Guesses per second | Time to crack (average) |
|---|---|---|
| Online, rate-limited login | 100 / hour | – |
| Online, no rate limit | 10 | – |
| Offline, slow hash (bcrypt, Argon2) | 10,000 | – |
| Offline, fast hash (MD5, SHA-1, NTLM) | 10 billion | – |
Every character comes from crypto.getRandomValues, the same cryptographically secure random number generator your browser uses for TLS keys. It is seeded by the operating system's entropy pool, not by the clock or by Math.random(), whose output can be predicted from a handful of earlier values.
Turning random bytes into characters is where many generators go subtly wrong. A 32-bit random number taken modulo 94 symbols makes the first few symbols slightly more likely than the rest, because 232 is not a multiple of 94. This page uses rejection sampling instead: a draw that falls in the uneven tail is discarded and redrawn, so every symbol in the chosen set has exactly the same probability.
"One of each set" works the same way. Rather than forcing a digit into a fixed slot, which would make positions predictable, a whole candidate password is drawn and thrown away if it is missing a set. The result is uniform across every password that satisfies the rule. Generation, strength analysis and the passphrase word list all run inside this page; the password is never written to the address bar, the history panel or browser storage.
Strength is measured in bits of entropy: the base-2 logarithm of the number of equally likely passwords the generator could have produced. Each extra bit doubles the attacker's work. With all four character sets (90 symbols), each character adds about 6.5 bits.
| Use | Target | Random password | Diceware passphrase |
|---|---|---|---|
| Website account behind a rate limit and a password manager | 60–80 bits | 12–14 characters | 5–6 words |
| Password manager master password, disk encryption | 80–100 bits | 15–16 characters | 7–8 words |
| API keys, service accounts, anything hashed with a fast hash | 128 bits | 20+ characters | 10 words |
| Wi-Fi (WPA2/WPA3 personal) | 80+ bits | 16+ characters | 7 words |
These figures assume the password was produced randomly. A human-chosen password of the same length is far weaker, because people pick from a tiny, predictable part of the space, which is what the strength checker on the right measures.
A Diceware passphrase strings together words picked at random from the Electronic Frontier Foundation's list of 7,776 words. Each word is worth log2(7,776) ≈ 12.9 bits, so six words give about 77.5 bits, roughly a 12-character random password with every character class. The words were chosen by the EFF to be common, distinct and easy to type, so a passphrase is much easier to remember and to enter on a phone or a TV remote.
The strength comes from the random choice, not from the words being obscure: an attacker who knows you used this exact list and six words still has 277 combinations to try. Choosing the words yourself, or picking a famous phrase, removes that protection entirely. Use a passphrase for anything you must type from memory; use a long random password for everything a password manager fills in for you.
For a password you typed, counting character classes badly overestimates strength: P@ssw0rd1! uses all four classes yet is one of the first guesses in every cracking list. The checker therefore looks for the patterns real cracking tools try first and prices each one at its actual cost to guess:
qwerty, asdf and 1qaz2wsx, forwards and backwards.abcd, 9876, aaaa and abcabc.It then finds the cheapest way to describe the whole password as a mix of those patterns and brute-forced characters, and reports that cost in bits. The crack-time table divides the average number of guesses by four realistic attack speeds. The offline figures assume the attacker has stolen the password database; whether your password survives then depends far more on the site's hashing (bcrypt or Argon2 versus MD5) than on anything you control, which is why a unique password per site matters more than any single password's length.
A strong random password is only useful if it is unique to one account and kept somewhere safe. A password manager such as Bitwarden, 1Password, KeePassXC or the one built into your browser or phone is the right home for it: it generates, stores and fills passwords so you never need to remember more than the master passphrase. Turn on two-factor authentication, preferably a passkey or a hardware key, for email and anything financial. When a site supports passkeys, prefer them over passwords altogether.
It is safe when the generation happens in your browser and nothing is transmitted, which is how this page works: the password is produced by your browser's crypto.getRandomValues and displayed on the page, with no request to any server. You can confirm it by opening your browser's developer tools on the Network tab, or by loading the page and then switching off your connection; it keeps working. The page also never puts the password in the URL, the history panel or local storage.
For a randomly generated password with uppercase, lowercase, digits and symbols, 14 characters gives about 90 bits of entropy, enough for any account protected by a reasonable hash. Use 16 or more for a password manager's master password or disk encryption, and 20 or more for API keys and service accounts. If a site restricts you to letters and digits, add three or four characters to make up the difference. Length matters more than complexity: every extra character multiplies the work for an attacker.
Yes, if the words are chosen randomly. Each word from the 7,776-word EFF list adds about 12.9 bits, so six random words carry about 77.5 bits, comparable to a 12-character random password with all character classes, and seven words carry about 90 bits. The attacker is assumed to know the list and the number of words. A passphrase is weak only when a person picks the words, because people choose phrases, song lyrics and quotes that cracking dictionaries contain.
Because attackers do not guess character by character. Cracking tools start with lists of leaked passwords and apply the same substitutions and suffixes people use, such as @ for a, 0 for o and a trailing 1 or !. P@ssw0rd1! is the word password with the most common substitutions and suffixes, so it falls within the first few thousand guesses. The checker detects those patterns and prices them at their real guessing cost rather than counting character classes.
It removes characters that are easy to misread when a password has to be typed from a screen or paper: capital I, lowercase l, the digit 1, capital O, lowercase o, zero, and the pipe, backtick and quote characters. It reduces the pool slightly, for example from 90 to 82 symbols, which costs about 0.1 bit per character. The entropy figure shown always reflects the actual pool in use, so you can add a character to compensate if you want the same strength.
The checker estimates how many guesses an attacker needs on average, which is half the size of the space described by the password's entropy, and divides by a guessing rate for four scenarios: 100 guesses an hour against a rate-limited login form, 10 a second against an unprotected one, 10,000 a second against a stolen database hashed with bcrypt or Argon2, and 10 billion a second against a database hashed with MD5, SHA-1 or NTLM on a GPU rig. Real attacks vary by orders of magnitude, so read the figures as a comparison, not a guarantee.