Password Generator
Generate strong random passwords and passphrases with an entropy readout.
Guide & FAQHow many characters is enough? · Where the crack-time numbers stop applying · Practical answers · What actually makes a password strong · Passwords vs passphrases · Rules that no longer apply · Practical checklist · Frequently asked questions
How many characters is enough?
The generator defaults to 16, and the honest answer to "is 8 enough" is no. With the full character set here — 26 lowercase, 26 uppercase, 10 digits and 25 symbols, so 87 possibilities per position — each character adds about 6.44 bits. That gives:
| Length | Entropy | Time to crack offline |
|---|---|---|
| 8 | 52 bits | about 27 minutes |
| 12 | 77 bits | roughly 3,000 years |
| 15 | 97 bits | around 2 billion years |
| 16 | 103 bits | around 170 billion years |
| 20 | 129 bits | longer than the universe has existed, by a wide margin |
| 24 or more | 155+ bits | the number stops meaning anything |
Those figures assume an offline attack at a trillion guesses per second — someone has stolen the password database and is running it against fast hardware. That is the scenario worth designing for, because it is the one where the attacker has no rate limit.
Where the crack-time numbers stop applying
Three caveats, because a table like the one above is easy to over-read.
The hash matters more than the length, up to a point. A trillion guesses per second is realistic against a fast hash such as unsalted SHA-256. Against bcrypt, scrypt or Argon2 — which exist precisely to be slow — the same hardware manages thousands or millions of guesses per second, not trillions. A 12-character password behind Argon2 is far safer than a 16-character one behind MD5. You rarely get to choose, which is why length is the lever you do control.
Online attacks are a different problem. Guessing against a live login is limited by the service's rate limiting and lockout, so even a weak password survives far longer there. The offline case is the one that has actually leaked billions of real passwords.
None of this applies to a password you reused. If the same password protects two accounts and one of them leaks, its entropy is irrelevant — the attacker does not need to guess it. Length protects against guessing, and only a password manager protects against reuse.
Practical answers
- 8 characters is not enough for anything that matters, whatever the site's minimum says. It is inside the range a determined attacker brute-forces on stolen hashes.
- 12 is a reasonable floor when something imposes a limit and you cannot go higher.
- 16 is the sensible default, which is why it is the default here. It costs nothing extra when a password manager types it for you.
- Beyond about 20 there is no security argument left — the difference between 129 bits and 206 bits is the difference between two impossibilities. Longer is only worth choosing if a policy demands it.
If you have to type the password by hand rather than paste it, use the passphrase generator above instead. Four or five random words are easier to type accurately and reach comparable entropy at a length no one would choose to type as random characters.
What actually makes a password strong
Strength is measured in entropy — the number of equally likely possibilities an attacker must search. It is length × log₂(alphabet size). Length dominates: adding one character to a 62-symbol alphabet multiplies the search space by 62, while adding symbols to a fixed-length password barely moves the needle.
| Entropy | Verdict |
|---|---|
| < 40 bits | Weak — crackable in minutes by a modern GPU rig |
| 40–60 bits | Fair — acceptable only with rate limiting behind it |
| 60–80 bits | Strong — suitable for most online accounts |
| 80+ bits | Very strong — appropriate for password managers, encryption keys and admin accounts |
Passwords vs passphrases
A random 16-character password from a 94-symbol alphabet carries about 104 bits of entropy but is impossible to remember. A five-word passphrase drawn from a 2,000-word list carries about 55 bits and you can memorise it in a minute. Use a passphrase for the handful of secrets you must type from memory — your device login and your password manager's master password — and let the manager generate long random strings for everything else.
Rules that no longer apply
Current NIST guidance drops the old advice to force mixed character classes and rotate passwords every 90 days. Both push people toward predictable patterns such as Summer2024!. What matters instead: reasonable length, no reuse across sites, screening against known breached passwords, and multi-factor authentication.
Practical checklist
- Use a unique password for every account — reuse is what turns one breach into ten.
- Store them in a password manager rather than a notes app or spreadsheet.
- Turn on multi-factor authentication wherever it is offered; it defeats most credential-stuffing attacks outright.
- Never send a password over email or chat. If you must share one, use a one-time secret link.
Frequently asked questions
Is it safe to generate a password on a website?
On this one, yes — the generator runs entirely in your browser using crypto.getRandomValues(), and the page has no backend to send anything to. You can verify by loading the page, disconnecting from the network, and generating passwords offline.
How long should a password be?
Sixteen random characters is a good default for online accounts. Go to 20 or more for password-manager master passwords, encryption keys and anything protecting other credentials.
Should I include symbols?
Symbols help, but far less than length. A 20-character letters-and-digits password is stronger than a 12-character one with symbols, and it avoids sites that quietly reject certain punctuation.
What does "exclude look-alikes" do?
The option removes characters that are easy to confuse when read aloud or transcribed — 0/O and 1/l/I. Useful for passwords you will type by hand or dictate; it slightly reduces entropy per character.
Do I still need to change passwords regularly?
Only when there is a reason — a breach notification, a shared password, or a suspicion of compromise. Scheduled rotation without cause mostly produces weaker, more predictable passwords.