Help

Password Generator creates random, secure passwords entirely in your browser. Pick the length and the character sets, press Generate and copy the result. The panel next to the generator shows how many bits of entropy your password has and roughly how long different hacking technologies would need to crack it — explained in plain language.

Generate a password

Start by setting the length (number of characters) and tick the character sets you want to use: lowercase, uppercase, digits and symbols. Press Generate and the password appears in the field above. You can reveal it with Show password, copy it with Copy and generate a new one at any time.

The options

• Length — 4 to 128 characters. Use at least 12 for important accounts; 16 or more is a good default.
• Character sets — the more different types of characters, the larger the search space.
• Exclude ambiguous characters — removes easily confused characters such as l, 1, I, O and 0.
• Always begin with a letter — useful for services that require the first character to be a letter.
• No identical characters in a row — avoids doubled letters such as aa or 11.
• At least one character from every selected set — guarantees the password contains all chosen character types.

Entropy and rating

Entropy measures the search space in bits. Every additional bit doubles the effort for an attacker. A 16-character password with all four character sets has roughly 97 bits — a gigantic search space. The rating translates the entropy into simple words (very weak up to very strong).

How the crack-time table works

The table below the generator estimates how long four different attack technologies would need, on average, to find your password. The estimates assume your password is stored as a classic, fast password hash (as used by older systems) and that the attacker knows the character sets you used. Modern password hashing such as bcrypt or Argon2 is deliberately thousands of times slower, which makes every listed time much longer in practice.

The technologies in plain language

• Dictionary attack — tries words from dictionaries and from password lists leaked in data breaches plus simple variations. It finds human-made passwords almost instantly but is useless against random ones.
• Home computer — a normal PC tries every combination in order (brute force), roughly a few million guesses per second.
• GPU cracking rig — professional hardware with many graphics cards tries tens of billions of guesses per second; the realistic threat in real attacks.
• Botnet — thousands of hijacked computers working together; the fastest scenario, so the password must be really long.

Privacy

Everything runs locally in your browser. Passwords are generated with your browser's secure random generator (crypto.getRandomValues) and are never sent to a server or stored anywhere. This is why the app is marked as green (Local).