Password Generator

What Makes a Password Actually Strong

Strength comes from exactly two things: entropy (the number of possible combinations an attacker would have to try) and uniqueness (it's not used anywhere else). Length and randomness drive entropy. Reuse — even of a strong password — destroys it.

A 16-character random password drawn from 94 printable characters has roughly 10³¹ possible combinations — about 105 bits of entropy. To brute-force it, an attacker running a billion guesses per second would need over 10¹⁵ years. The universe is about 1.4 × 10¹⁰ years old. There is no future technology that changes this fundamental arithmetic for properly long random passwords. The math protects you completely — as long as you actually use long, random, unique passwords.

How Long Does It Take to Crack a Password?

Modern GPU rigs can attempt billions of hashes per second against leaked password databases. The numbers tell the story:

Estimates from Hive Systems' 2024 password table assuming bcrypt cost 5. For unsalted MD5 (still used by some legacy systems), divide all times by ~10⁶.

The Real Threat: Database Breaches and Credential Stuffing

The most common way passwords actually get compromised isn't brute force. It's database leaks from breached websites. Once a database is leaked, attackers crack the password hashes offline and then try those email/password combinations against every other site — banking, email, shopping. This is called credential stuffing, and it's the #1 source of account takeovers worldwide.

The Statistic That Should Scare You

Verizon's annual Data Breach Investigations Report consistently shows the same root cause: roughly 80% of hacking-related breaches involve stolen or weak credentials. Of those, the overwhelming majority succeed because users reused a password from one site on another. The attacker doesn't need to crack your bank password — they just buy a list of breached Netflix passwords on a dark-web forum and try them on every bank login form until one works.

The 3 Rules That Actually Matter

1. Length over complexity. A 20-character random password is stronger than a 10-character one with five special characters. Always go for length.
2. Unique per site. If your email password leaks, the only damage should be your email. The attacker should not be able to log in to your bank with the same credentials.
3. Use a password manager. No human can remember 80+ unique 20-character random passwords. A password manager does it for you. Trying to memorize them is how you end up reusing them.

Password Managers — The Right Tool for the Job

A modern password manager generates random passwords, stores them encrypted, fills them automatically in browsers and apps, and warns you if any of your stored passwords has appeared in a known breach. Recommended options:

• Bitwarden — open source, free tier is generous, audited. Good default for most people.
• 1Password — slick UI, family plans, paid only. Best if you'll share with family/team.
• KeePass / KeePassXC — local, open source, free. Best if you don't want anything in the cloud.
• Built-in (Chrome / Safari / Firefox) — fine for casual users, but locks you into a browser ecosystem.

One master password unlocks everything. Make that master password a long passphrase you'll remember (four random words like correct horse battery staple gives ~44 bits of entropy and is memorable). And turn on 2FA on the password manager itself.

Two-Factor Authentication (2FA) — Even More Important Than Strong Passwords

Even a perfectly strong password can be stolen via phishing or malware. Two-factor authentication adds a second proof of identity — usually a 6-digit code from an authenticator app — that the attacker doesn't have. Microsoft's security team has stated publicly that 2FA blocks 99.9% of automated account-takeover attempts.

Priority order for enabling 2FA: email accounts → financial accounts → cloud storage → social media → everything else. Use an authenticator app (Authy, Google Authenticator, 1Password's built-in TOTP) instead of SMS where possible; SMS-based 2FA is vulnerable to SIM-swap attacks.

Why This Generator Is Safe

Generation happens entirely in your browser using crypto.getRandomValues — a cryptographically secure random number generator built into every modern browser. Nothing is transmitted to our server, nothing is logged, nothing is stored after you close the tab. We genuinely can't see the passwords you generate; the math doesn't allow it. That said, you should still copy the password into a password manager immediately and not leave the browser tab open with it visible.

Common Password Mistakes

• Substituting letters with similar-looking symbols (P@ssw0rd). Crackers know all the standard substitutions. They add no real entropy.
• Adding a year or "!" to a known word (Summer2024!). Crackers iterate through years and trailing symbols automatically. This breaks in under a minute.
• Using personal information (name, birthday, pet's name). All publicly available or guessable via social media.
• Reusing a "strong" password everywhere. One breach compromises everything. Worse than a weak unique password per site.
• Writing passwords on sticky notes / unencrypted text files. Defeats the point of having a password.
• Storing passwords in browser without a master password. Anyone with physical access to your unlocked device gets your entire vault.
• Forced rotation every 90 days. Research (and NIST's own guidelines) show this leads to weaker passwords because users iterate (Password1, Password2, Password3...). Only rotate when you have reason to suspect compromise.

Frequently Asked Questions