Password Generator — Free Online Calculator with Step-by-Step Guide

How Password Gen Works

E = L × log₂(S)

Entropy (E) = Password Length (L) × log₂(Character Set Size (S)). Higher entropy means exponentially stronger resistance to brute-force attacks. Each additional bit of entropy doubles the number of guesses an attacker must try. For example, a password with 40 bits of entropy requires about 1 trillion guesses (2^40), which a modern GPU cluster can crack in seconds. A password with 80 bits of entropy requires about 1.2 × 10^24 guesses — essentially uncrackable by brute force with current technology.

E

Entropy (bits) — A measure of password strength. Each bit of entropy doubles the number of guesses required for a brute-force attack. 60+ bits is decent, 80+ is strong, 100+ is extremely strong.

L

Password Length — The total number of characters in the password. Every extra character multiplies the guess space by S (the character set size), making length the single most important factor for password strength.

S

Character Set Size — The number of possible characters for each position in the password. Lowercase alone = 26, + uppercase = 52, + digits = 62, + symbols = 95+. Mixing types dramatically increases S.

How to Use

1. Select at least one character type to include in your password (lowercase, uppercase, digits, symbols).
2. Adjust the password length slider — each additional character multiplies the number of possible passwords.
3. Choose "Random String" for maximum security or "Passphrase" for a password of random words that is easier to remember.
4. Enable "Avoid Ambiguous Characters" to exclude easily confused characters like O/0 and I/l/1.
5. Review the calculated entropy (bits) and estimated time-to-crack to decide if the password is strong enough.

Understanding the Result

Password strength is measured in bits of entropy. A password with N bits of entropy requires roughly 2^N guesses to crack via brute force. Modern password-cracking hardware — including GPU clusters and purpose-built ASICs — can attempt billions of guesses per second against unsalted, unhashed passwords, and millions per second against properly hashed passwords using algorithms like bcrypt, argon2, or PBKDF2. This is why we recommend passwords with at least 80 bits of entropy for important accounts like email and banking. Using a mix of character types (uppercase, lowercase, digits, symbols) dramatically increases the character set size S from 26 (lowercase only) to 95+ (all types). Increasing length L has a multiplicative effect on total entropy. For memorability, passphrases composed of 4-6 random words from a large dictionary offer 44-66 bits of entropy depending on word count, which is comparable to a moderately strong random string but significantly easier to remember and type. For maximum security, a long random string of 16+ characters is still the gold standard.

Frequently Asked Questions

What is entropy and why does it matter?

Entropy measures how unpredictable your password is, expressed in bits. Each bit of entropy doubles the number of guesses needed to crack it. A password with 40 bits (like a typical 8-character lowercase password) can be cracked in seconds by modern hardware. An 80-bit password provides strong protection against brute-force attacks even with dedicated hardware. For context, most security experts recommend 60-80 bits for standard accounts and 100+ bits for high-value accounts like password managers and financial services.

Is a passphrase as secure as a random string?

A passphrase of 4-5 random words from a large dictionary (e.g., the EFF long word list with 7,776 words) provides roughly 52-65 bits of entropy, which is comparable to a 10-12 character random alphanumeric string. Passphrases are primarily beneficial because they are easier to remember, type accurately, and transcribe over the phone. However, for maximum security, a long random string (16+ characters with all character types) is still superior, providing 100+ bits of entropy.

What does "Time to Crack" mean?

This is an estimate of how long it would take an attacker to guess your password by trying every possible combination (brute force), assuming 1 billion guesses per second — a conservative estimate for modern GPU-based cracking hardware. Real-world attacks may be faster (using specialized ASICs) or slower (against well-hashed databases using bcrypt/argon2). The estimate assumes the attacker knows your password's character set and length. For properly hashed passwords, the cracking speed is dramatically reduced by the hash algorithm's computational cost.

Should I use ambiguous characters?

Ambiguous characters like O (letter) vs 0 (zero) and I (uppercase i) vs l (lowercase L) vs 1 (one) can cause problems when manually typing, reading over the phone, or transcribing passwords from paper. If you need to share passwords verbally or write them down temporarily, avoiding these characters reduces errors. For password managers (where you copy-paste the password), ambiguous characters are perfectly fine and add to the entropy.

Why does this use crypto.getRandomValues() instead of Math.random()?

crypto.getRandomValues() is a cryptographically secure pseudo-random number generator (CSPRNG) designed for security-sensitive applications like password generation, encryption key generation, and secure tokens. Math.random() is a general-purpose PRNG optimized for speed, not security — it is predictable if an attacker can obtain enough samples. Math.random() should never be used for passwords, session IDs, CSRF tokens, or any security-critical randomness.

How should I store my generated passwords?

The safest way to store passwords is in a dedicated password manager like 1Password, Bitwarden, LastPass, or KeePassXC. These tools encrypt your password vault with a strong master password and automatically fill passwords on websites. Writing passwords on paper is also secure if stored safely. Never store passwords in plain text files, spreadsheets, sticky notes on your monitor, or unencrypted digital notes.

Sources

• NIST SP 800-63B - Digital Identity Guidelines
• Wikipedia - Password Strength