⚡ Everyday Utility
🆓 Free
🔒 Secure
🔐 Password Generator
Generate a cryptographically random password instantly - choose length from 8 to 64 characters, select which character types to include, and see the password strength and entropy in bits. All generation happens locally in your browser - nothing is ever sent to a server. Includes a passphrase generator and bulk generation for multiple accounts.
🔐 Generate Password
Click Generate to create a password
Quick Presets
📋 Bulk Password Generator
🔍 Password Strength Checker
Enter any password to instantly check its strength. Your password is never stored or sent anywhere.
🛡️ Password Security Best Practices
📏
Use at least 16 characters. Length is the single most important factor. A 16-char password with only lowercase is far stronger than an 8-char password with all character types.
🔀
Mix character types. Combine uppercase, lowercase, numbers, and symbols. This dramatically increases the number of possible combinations (the "charset size").
🔑
Use a unique password for every account. If one site is hacked and your password is exposed, attackers will try it on every other service. This is called "credential stuffing."
🗝️
Use a password manager. Tools like Bitwarden (free), 1Password, or LastPass securely store all your passwords. You only need to remember one master password.
📵
Never use personal information. Birthdays, names, phone numbers, and pet names are easy to guess - especially for people who know you or can find you on social media.
📖
Avoid common passwords. "password", "123456", "qwerty", "iloveyou" are the first things hackers try. Over 80% of data breaches involve weak or reused passwords.
📱
Enable Two-Factor Authentication (2FA). Even if your password is stolen, 2FA prevents hackers from accessing your account without your phone or authenticator app.
🔄
Change passwords after breaches. Check haveibeenpwned.com to see if your email has appeared in data breaches. Change affected passwords immediately.
🧠
Use passphrases for master passwords. A random sequence of 4-5 words ("correct horse battery staple") is easy to remember but extremely hard to crack - stronger than most complex passwords.
🚫
Never share passwords via chat or email. Legitimate services will never ask for your password. Sharing via messaging apps is risky - use a secure password sharing feature in your password manager instead.
⚠️ Most Common Passwords to NEVER Use
📐 Password Security Math
Charset Size
Lowercase only (a-z): 26 characters
+ Uppercase (A-Z): 52 characters
+ Numbers (0-9): 62 characters
+ Symbols (!@#$%^&*...): 94 characters
+ Uppercase (A-Z): 52 characters
+ Numbers (0-9): 62 characters
+ Symbols (!@#$%^&*...): 94 characters
Number of Possible Combinations
Combinations = Charset Size ^ Password Length
Example: 16-char password with 94 charset:
94^16 = 37,157,429,083,410,091,685,945,344 combinations
≈ 3.7 × 10^28 possible passwords
Example: 16-char password with 94 charset:
94^16 = 37,157,429,083,410,091,685,945,344 combinations
≈ 3.7 × 10^28 possible passwords
Password Entropy (bits)
Entropy measures unpredictability. Higher entropy = stronger password.
Entropy (bits) = log₂(Charset Size ^ Length)
= Length × log₂(Charset Size)
128-bit entropy is considered unbreakable.
A 20-char password with full charset has ~131 bits.
= Length × log₂(Charset Size)
128-bit entropy is considered unbreakable.
A 20-char password with full charset has ~131 bits.
Time to Crack (Brute Force)
Crack Time = Combinations ÷ Guesses Per Second
Modern GPU: ~10 billion (10^10) guesses/second
Botnet: ~100 trillion (10^14) guesses/second
A 128-bit entropy password would take longer than
the age of the universe to crack even with a botnet.
Modern GPU: ~10 billion (10^10) guesses/second
Botnet: ~100 trillion (10^14) guesses/second
A 128-bit entropy password would take longer than
the age of the universe to crack even with a botnet.
❓ Frequently Asked Questions
AI Insights - Coming Soon!
AI-powered password policy advisor, personalized security recommendations, and breach risk analysis.
⏳ Coming Soon - Stay Tuned!
Password Generator - What Makes a Password Truly Secure
Most people dramatically underestimate how fast modern password-cracking tools work. An 8-character password using only lowercase letters can be cracked in seconds. The same password with mixed case and numbers takes a few hours. A 16-character fully random password using all character types would take millions of years with current hardware. Length and true randomness are what matter - not adding "1!" to your pet's name.
How entropy works: A 16-character password using all 94 printable ASCII characters has entropy = 16 × log₂(94) = 16 × 6.55 = 104.8 bits. At 1 trillion guesses per second (current top-end hardware), cracking it would take longer than the age of the universe. A 12-character all-lowercase password has only 56 bits - crackable in a few months.
Password Strength at a Glance - What Each Level Means
Weak and Moderate Passwords
- Very Weak (under 40 bits): Short, simple, or uses only one character type. Cracked in seconds to hours.
- Weak (40–60 bits): 8–10 character mixed passwords. Vulnerable to dedicated attacks in hours to days.
- Moderate (60–80 bits): 10–12 characters with full character set. Usable for low-risk accounts but not recommended for banking or email.
Strong and Very Strong
- Strong (80–100 bits): 12–16 characters, fully random, all character types. Appropriate for most accounts.
- Very Strong (100–128 bits): 16+ characters. Suitable for high-value accounts - email, banking, password manager.
- Unbreakable (128+ bits): 20+ characters. Computationally impossible to brute-force with any foreseeable hardware.
- 16 characters = recommended minimum for all important accounts.
Passwords vs Passphrases - When to Use Each
A passphrase is a sequence of 4–6 random dictionary words - "correct-horse-battery-staple" - rather than a string of random characters. They have some advantages for specific use cases:
- Memorability: A 4-word passphrase is far easier to remember than "xK9#mP2@vQ7!nL4&". This matters for passwords you must type without a password manager - like your computer login or password manager master password.
- Entropy: 4 truly random words from a 7,776-word wordlist (the EFF wordlist) give approximately 51 bits of entropy. 5 words give 64 bits. 6 words give 77 bits. This is comparable to a 10–12 character random character password.
- Use random word selection: "ilovemycat" is not a passphrase - it's a predictable phrase. A passphrase must use genuinely random word selection, like rolling dice or using the generator above.
- Character passwords are better when: Stored in a password manager (memorability doesn't matter, maximum entropy does), or required by a system with specific character requirements.
The Essential Password Security Rules
- Never reuse passwords. When one service is breached (and they are breached constantly), attackers try stolen credentials on every other major service. Unique passwords for every account limit breach damage to that one account.
- Use a password manager. The only realistic way to have unique, strong passwords for every account. Reputable options: Bitwarden (open-source, free), 1Password, Dashlane. Your master password should be a long, memorable passphrase.
- Enable Two-Factor Authentication (2FA) on all important accounts. Even if a password is compromised, 2FA requires a second factor - typically a time-based code from your phone. Use an authenticator app (Authy, Google Authenticator) rather than SMS 2FA where possible, as SMS can be intercepted.
- Check for breached accounts. Visit haveibeenpwned.com to see if your email address appears in known data breaches. If it does, change the password for that service immediately.
- Use long passwords, not complex short ones. "correcthorsebatterystaple" (25 characters, lowercase) is stronger than "P@ssw0rd" (8 characters with symbols). Length beats complexity.