What makes a password strong
A password is strong when it is hard to guess, and nothing else. Not when it has a capital letter, not when it has a symbol, not when it satisfies a form's validation rules — those were written to nudge people away from dragon and 123456, and what they mostly produced was Dragon1!.
6 words → candle-anchor-copper-piano-amber-tide — exactly 60 bits, because the list holds exactly 1024 words and every word is one uniform draw from it
What actually resists guessing is unpredictability, and a person cannot supply it: human-chosen passwords cluster in the same few shapes, and an attacker's dictionary knows every one of them. So the useful question is never how a password looks but how many equally likely results the thing that made it could have produced instead — which is the number reported beside every result here. Every character and every word is drawn in your browser by crypto.getRandomValues, and nothing on this page is ever transmitted.
Entropy, and what the number means
Entropy is that set size, written as a power of two. A password with 40 bits of entropy is one of 2⁴⁰ — about a trillion — equally likely results. Each extra bit doubles the work, so 41 bits is twice as hard as 40, and 60 bits is a million times harder.
Bits come from the number of choices multiplied by how many times you make one. A random character out of 94 is log₂(94) ≈ 6.55 bits, so twenty of them is about 131. A word out of the 1024-word list is exactly 10 bits, so six words is exactly 60. A digit is log₂(10) ≈ 3.32 bits, which is why a six-digit PIN comes to 19.9 no matter how carefully it was drawn.
The figure describes the generator, not the string that came out of it. That distinction is where most strength meters go wrong: they inspect the characters, find mixed case and a symbol, and award points. But Password1! and a random k7#Qm2vL look similar to a checker and are astronomically far apart in practice, because one came from a list of common shapes and the other from a uniform draw.
It also means the number moves when you change a setting, not when you press regenerate. Two passwords made with the same options are exactly as strong as each other, however different they look.
| Band | Bits | Against the default attacker |
|---|---|---|
| Very weak | 0+ | Falls in seconds. Fine for nothing. |
| Weak | 40+ | Falls in minutes to weeks. Not enough for an account. |
| Fair | 60+ | Months to a few hundred thousand years. Adequate, not comfortable. |
| Strong | 80+ | Out of reach of a single rig today. |
| Very strong | 112+ | Out of reach of any attacker worth modelling. |
One wrinkle, and it goes the honest way. A random password is guaranteed to contain at least one character from every class you switched on, which removes every result that misses a class — so the real keyspace is slightly smaller than the pool size raised to the length. This tool counts the difference by inclusion–exclusion rather than ignoring it. At twenty characters it costs well under a bit; at four characters it is worth knowing about.
How long it takes to crack
There is no such thing as the time to crack a password. The same secret falls in an afternoon or outlasts the sun depending entirely on who is guessing and what they are guessing against, and a tool that shows one number without saying which is hiding the interesting part.
So the attacker is a control here rather than a hidden constant. Pick the scenario that matches what you are protecting: a password on a live login form is up against something very different from the same password sitting in a database that leaked.
| Scenario | Guesses/sec | What it models |
|---|---|---|
| Rate-limited login | 10² | Guessing at a login form that rate-limits. Nothing has leaked. |
| Leaked bcrypt hashes | 10⁴ | A breach where passwords were hashed with bcrypt at cost 12, attacked offline on a multi-GPU rig. |
| Leaked SHA-256 hashes | 10¹¹ | A breach where a fast hash was used. The default, because it is the common case. |
| Leaked MD5 or NTLM | 10¹² | A breach using MD5 or NTLM — still depressingly common. The worst case worth planning for. |
The rates are rounded to a power of ten on purpose. They are the order of magnitude of published hashcat-class benchmarks for a multi-GPU rig, not measurements taken here, and each GPU generation moves them. A figure like 164,100,000,000 would imply a precision this estimate does not have. If you need current numbers, run hashcat -b on the hardware you are actually worried about.
The result is written out rather than abbreviated: 410 quintillion years, not 4.1E20 and not 410,000,000T. Both of those are the same figure, and neither is a quantity anyone can picture. Past a decillion — 10³³ — the names stop helping too, so the estimate switches to 10ⁿ notation, and once it has outrun the age of the universe it says by how many times rather than leaving you to divide.
The time shown is the average, not the worst case. A search through a uniformly random secret finds it after half the candidates, so the figure is half the keyspace divided by the rate. Exhausting the whole space takes twice as long — reporting that instead would be the more flattering error.
The estimate assumes the attacker knows exactly which settings produced the password and searches only that keyspace. That is deliberately pessimistic: not knowing makes their job harder, never easier, so the figure stays a lower bound on the work. It is also why guessing a human-chosen password is so much faster than these numbers suggest — a word, a capital at the front and a digit at the end is a shape rather than a secret, and nine characters built that way fall in seconds where nine drawn at random do not.
The three types
Three ways to make a secret, for three different jobs. The type also decides which of the controls below do anything.
| Type | Range | Bits each | Reach for it when |
|---|---|---|---|
| Random | 4–128 | ≈6.55 / character | Anything a password manager will remember for you. This is the default, and it should stay the default. |
| Memorable | 3–12 | 10 / word | A secret you have to type from memory or read aloud — a device login, a disk passphrase, a Wi-Fi key. |
| PIN | 3–12 | ≈3.32 / digit | A phone, a card or a lock that limits attempts. Never an account. |
The passphrase list holds exactly 1,024 words, and that number is the point: one word is exactly ten bits, so the arithmetic needs no rounding and six words is exactly sixty. Every word is three to eight lowercase letters and common enough to retype after reading it once — a passphrase you cannot remember is a passphrase you will replace with something worse.
A PIN has no options beyond its length, and that is not an oversight. Every rule you might add — no repeats, no runs, no birthdays — removes candidates and makes it weaker, not stronger. A six-digit PIN is one of a million, which an offline attacker clears instantly. It is safe only behind a device that locks after a handful of tries.
Every control, and what it changes
Nine controls. Three of them belong to a random password, three to a passphrase, and the rest apply throughout — so a control that cannot do anything in the current type is disabled and says why, rather than sitting there being ignored.
| Option | What it does | Reach for it when |
|---|---|---|
| Type | Switches between random characters, a wordlist passphrase and a numeric PIN. Each counts its length differently. | Start here — it decides which of the controls below are live. |
| Length | Characters, words or digits, depending on the type. The one lever that always increases strength. | Before reaching for anything else. Length beats complexity at every size. |
| Characters used | Which of the four alphabets a random password draws from. At least one character of every class you switch on is guaranteed to appear. | Turn symbols off when a system rejects them — then add length back to make up for the smaller pool. |
| Exclude look-alikes | Drops the glyphs that read as each other in most fonts. | Someone will read the password off a screen and type it somewhere else. |
| Exclude awkward symbols | Drops brackets, quotes, slashes and punctuation that shells, CSV columns and JSON strings mangle. | The password is going into a config file, a connection string or a command line. |
| Separator | What goes between the words of a passphrase. | Hyphen unless something downstream objects. It adds no entropy either way. |
| Capitalise each word | Upper-cases the first letter of every word in a passphrase. | A form demands a capital. It adds nothing to the strength. |
| Add a digit | Appends one digit to one randomly chosen word. | A form demands a number. Worth about six extra bits at six words. |
| Attacker | Chooses the guess rate the crack-time estimate assumes. | Match it to the threat you actually care about. It never changes the password itself. |
The gating follows one rule rather than a list of pairs: character classes and both exclusions need a character pool to trim, and only a random password has one. A passphrase is drawn from a wordlist and a PIN from the ten digits, so in those types the whole panel goes quiet. The three passphrase controls are the mirror of that.
Excluding look-alikes drops iIlL1oO0| — the classic seven plus the pipe, which is indistinguishable from a lowercase L in several common terminal faces.
Excluding awkward symbols drops {}[]()/\'"`~,;:.<>. Both exclusions cost entropy by shrinking the pool: all four classes together give 94 characters, and both exclusions leave 67. The meter accounts for it, so raise the length if the band drops.
Capitalising every word adds exactly zero bits, and the entropy figure says so. A rule the attacker can apply themselves is not a secret — it turns one candidate into one different candidate, and the set does not grow. The separator is the same kind of nothing. The digit is different: both the word it lands on and its value are drawn at random, so it really is worth log₂(words × 10) bits.
What the separator does change is what the password contains. A hyphen is a symbol, so candle-anchor-copper satisfies a form demanding a symbol without any of the character controls being involved. The composition row under the generator counts it, because the finished string genuinely does contain it.
The defaults are a twenty-character random password using all four classes with no exclusions, scored against leaked SHA-256 hashes. That comes to about 131 bits, which none of the attackers in the table gets close to. Switch to a passphrase and the default is six words — sixty bits — because that is the shortest passphrase that is not honestly weak.
Where the password goes
Nowhere. Every password on this page is composed in your browser: there is no request to generate one, no request after one is made, and no server that has ever seen one.
That is why the box is briefly empty when the page loads. Every other generator on this site renders its first result on the server and sends it down with the HTML, and this one deliberately does not. A generated secret in an HTTP response body is a secret that can end up in an access log, in a proxy that terminates TLS, or in whatever buffered the response on the way. The page ships a placeholder, and the first password appears a moment later, made locally.
The link carries your settings and never the result. A URL like ?mode=memorable&length=8 is safe to share or bookmark; a password in a query string would land in browser history, in the referrer header of the next page you visit, and in every log between here and there.
There is no download button either, and that is on purpose. Every other tool here offers one. Writing a secret into your downloads folder as a plain-text file, where it sits until you remember to delete it, is not a feature.
The one exposure worth knowing about is the clipboard. Copying puts the password somewhere any application on your machine can read it, and it stays there until something replaces it. Paste it into your password manager, then copy something harmless.
What to do with it
Use a password manager, and let it hold a long random password for every account. That is the whole recommendation, and it makes most of the rest academic: a password you never type can be thirty characters of noise, and the only one you have to remember is the one that unlocks the manager.
Make that one a passphrase. Six words from this list is sixty bits and you can memorise it in a couple of minutes; the same effort spent on random characters gets you about nine of them, which is worse. Length is the lever that always works — one more character on a random password is worth more than every complexity rule ever written.
Reuse is the failure that actually happens. Strength does not help if the same twenty-character password is also on a site that stored it badly: the attacker does not crack it, they read it and try it everywhere else. Unique per account is worth more than strong.
Turn on two-factor authentication wherever it is offered, and stop rotating passwords on a schedule. Forced expiry moves people from a strong password they chose once to a weak one they increment every quarter. Change a password when you have reason to think it leaked, not because ninety days elapsed.
Frequently asked questions
crypto.getRandomValues, the browser's cryptographically secure generator, seeded by the operating system. Math.random is never used anywhere in this tool: it is fast and predictable, and a predictable password generator is not one. Selections use rejection sampling rather than a modulo, so no character in the pool is very slightly more likely than another.