Password Generator (Strength & Entropy Meter)
Generate cryptographically strong passwords with length, symbol, and look-alike filters — entropy bits, pool size, strength rating, and offline crack time.
Password Generator — interactive calculator, computed instantly in your browser.
Password Strength: Entropy, Length, and What Actually Resists Attack
16 chars × log₂(88) ≈ 103 bits — every 5 bits doubles the guesswork
Pool size sets the base, length sets the exponent — two more characters beats one symbol rule
A strong password is a large random draw, nothing more mystical. This generator uses your browser's cryptographic random source to pick characters from a pool you control, then scores the result by entropy bits, pool size, and realistic offline crack time — the numbers that predict whether an attacker ever gets in.
1. Pool Size and Length
- Lowercase only: 26 options per position; add uppercase, digits, symbols and the pool approaches 90
- Length multiplies difficulty — two extra characters add roughly 13 bits, equal to billions of extra guesses
- Symbol rules add little compared with length: 12 forced-symbol characters lose to 16 random ones
- The look-alike filter trims the pool slightly and shows the real number in the pool card
2. Real Randomness vs. Human Patterns
- crypto.getRandomValues drives every character — never dictionary words, dates, or keyboard walks
- Substitution tricks (pa$$word) collapse to their base word under modern cracking rules
- Breached-password lists reject familiar phrases regardless of how clever the leet spelling looks
- Related idea, different tool: the 🎲 Random Number Generator for draws and samples
3. Reading the Strength Meter
- Entropy below 45 bits is weak; 45–60 fair; 60–80 strong; 80+ survives serious offline attack
- Crack time assumes 100 billion guesses per second against a strong hash — service rate limits stretch it further
- 28-bit passwords fall in seconds; 100-bit passwords outlast the universe at the same speed
- Bits are bits: the meter counts entropy the same way as the 🔢 Binary Converter shows them grouped
4. Use It With a Manager
Generated passwords only help when stored safely — pair this with a password manager so every site gets its own unique string, and protect the vault itself with a long passphrase plus two-factor authentication. Reuse, not weak generation, causes most breaches: one leaked database exposes every site sharing that password. Rotate credentials only when exposed, not on a calendar.
🔗 Security & Randomness
Entropy is the only property of a password that matters — length beats clever substitutions every time. See randomness from another angle in the 🎲 Random Number Generator or the 🔢 Binary Converter (entropy is counted in bits), all inside 🖥 Tech & Network Tools.
Use a unique credential per service — reuse, not weakness, is how most account breaches actually spread.
Frequently Asked Questions (Password Generator)
16 characters is the modern baseline for most accounts; 20-plus for anything high value. The length slider runs 6 to 64, and the entropy card shows exactly how each extra character multiplies the difficulty of a brute-force search.
Uniform draws from a character pool using a cryptographic random source, with no words, patterns, or dates. This generator uses crypto.getRandomValues — the same unpredictability services expect from server-side secrets.
Around 60 bits for ordinary accounts, 80+ for critical ones. Entropy is length times the log base 2 of the pool size, so a 16-character password from an 88-character pool lands near 103 bits — far beyond practical offline cracking.
They raise pool size from 62 to about 90 characters, adding roughly 0.5 bits per character — useful but secondary to length. If a site forbids symbols, add characters instead; the pool and entropy cards update to show the tradeoff.