Strong, random, and generated inside your browser. None of them leaves your machine.
Options
01 · what it is
It produces random combinations of characters using the browser's cryptographic generator — not a predictable algorithm, and not a person's intuition.
That distinction is the entire tool. Anyone can type sixteen characters that look scrambled, but "looks scrambled" and "is random" are different things, and only the second can be measured. A generator removes the person from the choice, and with them the pattern.
What you get back is a number: the bits of entropy shown above each password. It is the only honest answer to "is this password strong?", because it does not depend on how the string looks — it depends on how many combinations an attacker would have to try.
02 · the problem
Ask a hundred people for a random string and a hundred similar strings come back. Consonants alternate with vowels, because that can be pronounced. It starts with a capital, because that is how writing works. The symbol goes at the end and so does the number, usually a 1 or a year. Fingers stay near the middle of the keyboard. None of that is a conscious decision, which is precisely why it repeats.
Cracking software does not try combinations blindly. It tries what people write: lists from earlier breaches first, then dictionary words, then the usual transformations — a for 4, e for 3, a year on the end. A "creative" eight-character password falls in that phase, not to brute force.
The generator above produces the other kind. Every character comes from
crypto.getRandomValues(), and
any value that would introduce a bias is discarded — the ones that do not fall in an exact
multiple of the character set — so all 83 possibilities are equally likely. It is a small
detail almost nobody implements, and it is the difference between a uniform distribution and
one with favourites.
03 · the measure
Entropy is one line of arithmetic: log₂(pool size) × length. With all four character types the pool holds 83 distinct characters, so a 16-character password gives log₂(83) × 16 ≈ 102 bits. You can redo that on any calculator, which is the point: nobody has to be trusted.
Each bit doubles the attacker's work. That is why length pays far better than complexity: going from 8 to 16 characters multiplies the effort by billions, while swapping one letter for a symbol barely moves the figure.
| Configuration | Entropy | Time to crack |
|---|---|---|
| 8 characters, lowercase only | 37.6 bits | about a second |
| 8 characters, all four types | 51 bits | six days |
| 12 characters, all four types | 76.5 bits | seventeen thousand years |
| 16 characters, all four types | 102 bits | longer than the universe has existed |
Times assume 10¹¹ guesses per second, the order of magnitude of an offline attack with consumer graphics cards against a fast hash. An online attack against a service with rate limiting is millions of times slower. A cracking time without its stated assumption means nothing, which is why the assumption is written here.
04 · the limits
Worth saying on a page that exists to generate passwords: the password is the part of the problem that is already solved. One of 102 bits does not get cracked, and accounts are lost every day regardless.
They are lost other ways. By reuse: an excellent password repeated across five sites is worth whatever the weakest of the five is worth. By deception: if you type it into a page imitating your bank, its strength is irrelevant. Through the recovery email: whoever reaches that resets everything else without cracking anything.
So the honest recommendation is not "generate longer passwords" but: one per service, kept in a manager, with two-factor authentication wherever it exists. On an account with a second factor, the difference between 60 and 102 bits stops mattering; without one, no length saves you from a compromised recovery address.
Nothing is sold here and there is nothing to download, so that advice carries no second motive: in many cases the best security improvement is not a stronger password.
05 · length or complexity
The advice most people absorbed — mix upper and lower case, add a number, add a symbol — is not wrong so much as badly ranked. Each character type you add multiplies the size of the pool once. Each character you add multiplies the whole space again.
In figures: an eight-character password of lowercase letters carries about thirty-eight bits. Adding all three other character types takes it to fifty-one — a real gain. Leaving it lowercase and doubling the length to sixteen takes it past seventy-five. The second move is worth more than the first, and it is also the easier one to remember.
This matters practically because some services still refuse symbols, cap the length at twelve, or strip characters they dislike without saying so. When a site fights you on complexity, add length instead. When it caps the length, use every character it allows and turn on a second factor, because you have run out of room to do better.
The default here is sixteen characters with all four types for that reason: it is past the point where any offline attack is meaningful, and it stays short enough to type by hand on the rare occasion you have to.
06 · mistakes
Almost all of these survive using a password generator, because they happen after the password is made rather than while it is being made.
— Substituting characters: "Password" → "P@ssw0rd"
+ A random string of 16 characters
Cracking software has known those substitutions for twenty years. Swapping an a for an @ adds less than one bit — it is decoration, not disguise.
— Reusing one password across sites
+ A different password per service
A breach at any forum ends up being tried against your email and your bank. It is the most profitable attack there is and it requires cracking nothing.
— Changing passwords every ninety days
+ Changing them when there is a reason
Forced rotation pushes people toward predictable variants — Spring2026, Summer2026. Current guidance advises against it absent a specific suspicion.
— Keeping passwords in a spreadsheet
+ A password manager with encryption
An unencrypted file on the desktop or in cloud storage is readable by any program that reaches the machine, and it travels in every backup.
— Using personal details: dates, names, a licence plate
+ Characters with no relation to you
All of that is public or guessable. A targeted attack starts there, not with brute force.
07 · questions
Q01
Yes, with no limit and no sign-up. Generate as many as you need, close the page and come back tomorrow. There is no paid tier and no feature held back.
Q02
No. The password is assembled inside your browser using the machine's own cryptographic generator, and nothing is transmitted. When you close the tab it is gone from everywhere except wherever you saved it.
Q03
The randomness is the same — both use the browser's cryptographic interface. The difference is control and information: here you choose the character set, see the entropy in bits and know what cracking it would cost. The browser gets the basics right and shows you none of those figures.
Q04
With the entropy formula: log₂(pool size) × length. With all four character types the pool is 83 characters, so 16 positions give log₂(83) × 16 ≈ 102 bits. The cracking time assumes 10¹¹ guesses per second, which is the order of an offline attack with consumer graphics cards. You can redo the arithmetic yourself.
Q05
When there is a reason, not on a schedule. The advice to rotate every ninety days predates password managers and in practice produces predictable variants of the same password. Change one if the service announces a breach, if you typed it on someone else's machine, or if you shared it.
Q06
Save it in a password manager before closing the tab, because no copy is kept here. If the service offers two-factor authentication, turn it on as well: a 102-bit password is worth nothing if someone reaches your recovery email.
Q07
Because i, l, 1, o, O and 0 are hard to tell apart in many fonts and over the phone. Excluding them costs a few bits of entropy and saves a support call. Use the option when the password will be read aloud or copied from paper, and leave it off otherwise.
Q08
They help, but less than length does. Adding symbols to an eight-character password gains about thirteen bits; taking that password from eight characters to sixteen gains more than fifty. If a site refuses symbols — and some still do — add length instead and lose nothing that matters.
A different password per service, kept in a manager, with two-factor authentication where it exists. The generator supplies the random part; the rest is habit.