Password generator

What makes a password strong is not what most sites tell you

The advice almost everyone has absorbed — a capital letter, a number, a symbol, change it every ninety days — was written for a threat model that no longer exists, and NIST formally withdrew most of it years ago. Composition rules do not measure strength. They measure compliance with a rule, and people satisfy rules in predictable ways: the capital goes at the front, the number and the symbol go at the end, and the result is a word with decorations that an attacker's software strips off in the first second.

The thing that actually matters is entropy: how many equally likely possibilities the password was chosen from. It is measured in bits, each bit doubles the search, and it can be calculated exactly when — and only when — every character was picked independently at random. That last condition is why this tool does not force at least one digit into the output. The moment a generator guarantees a character class, it stops sampling uniformly and the real entropy drops below the number on the screen. A smaller honest number beats a larger invented one.

Where the randomness comes from, and why it is the whole tool

Every password here comes from crypto.getRandomValues, the browser's cryptographically secure random number generator, seeded by the operating system from sources an attacker cannot observe or reproduce. The alternative — Math.random — is designed for speed rather than secrecy. Its internal state can often be recovered from a modest number of outputs, and once recovered, every value it will ever produce is known. A generator built on it produces passwords that look identical to good ones and are not, which is the worst possible failure for a security tool because nothing about the output reveals it.

There is deliberately no fallback in this page. If a browser somehow does not offer the secure API, the tool reports that and generates nothing at all rather than degrading to something weaker while the strength figure carries on claiming otherwise.

The second detail that matters is how a random byte becomes a character. The obvious way is to take the byte modulo the size of the character pool, and it is subtly wrong: unless the pool divides evenly into 256, the first few characters of the pool come up slightly more often than the rest. The effect is small, but it is a real reduction in entropy and it makes the printed number an overstatement. This generator throws away any byte that falls outside the largest exact multiple of the pool size and draws again, which costs nothing noticeable and keeps the distribution flat.

Reading the strength figure

Two numbers are shown. The first is entropy in bits, calculated as the length multiplied by the base-two logarithm of the pool size — so a sixteen-character password drawn from every class this tool offers — 86 characters in all — carries about 103 bits. The second is what that means in time: how long an offline attack would take on average, assuming a trillion guesses a second against a fast unsalted hash.

That assumption is deliberately unkind. A trillion guesses a second is the sort of rate a well-resourced attacker reaches with rented GPUs when a breached site stored its passwords with a fast hashing function it should not have used. Against a slow modern function such as bcrypt or Argon2 the same password survives many orders of magnitude longer, and against a live login form with rate limiting the offline attack never happens at all. The figure is a floor, not a forecast, and the reason to show it rather than a coloured bar is that a floor can be compared and a colour cannot.

Look-alike characters, and when to leave them out

Zero and capital O, and the digit one against lowercase l and capital I, are indistinguishable in many fonts and cause real transcription errors. Removing them helps exactly one situation: a password that a human being will read from a screen and type somewhere else, or dictate over a phone. It costs entropy, because the pool gets smaller, and the tool shows the new figure immediately so the trade is visible rather than assumed. If the password is going straight into a password manager and no human will ever read it, leave them in and take the extra bits.

What to do with the password afterwards

A password strong enough to be worth generating is one you cannot memorise, and that is the intended outcome rather than a side effect. It belongs in a password manager, which turns the problem of remembering many secrets into the problem of remembering one, and that one should be a passphrase you can actually recall. Generating several at once here is for the common case of setting up a service that needs more than one credential — copy them as a block, paste them into the manager, and close the tab. Nothing on this page persists after you do.

The one habit worth more than any of this: never reuse a password across sites. Strength protects you against an attacker guessing. Uniqueness protects you against an attacker who already has one of your passwords from somewhere that was breached, and that is by far the more common way accounts are lost.