How this calculator works
Password security is the foundation of online safety — and most people get it wrong. Reused passwords, dictionary words, and predictable patterns (Password1!, Summer2024!) account for the majority of account breaches. The solution is simple: use a unique, randomly-generated password for every account, stored in a password manager. This generator creates cryptographically secure passwords that meet any website's requirements.
This Strong Password Generator uses your browser's cryptographic random number generator (Web Crypto API) — not pseudo-random JavaScript math — ensuring passwords can't be predicted. Customize length (12-64 characters), character sets (uppercase, lowercase, numbers, symbols), and exclude ambiguous characters (0/O, 1/l/I) for readability.
Best practices: use at least 16 characters for important accounts (email, banking, password manager master password). Enable two-factor authentication wherever available. Store passwords in a reputable password manager (Bitwarden, 1Password, KeePass) — never in a browser autofill for sensitive accounts. Never reuse passwords across accounts, especially email and banking.
The formula
Entropy = length x log2(character set size)
Character set sizes: lowercase 26, uppercase 26, digits 10, symbols ~32. All four: ~94 characters.
Crack time = 2^entropy / guesses per second
Strong password: minimum 80 bits of entropy (12+ chars with all sets)
Very strong: 100+ bits (16+ chars with all sets)
Worked example
A 16-character password with all character sets enabled might look like: 'K7#mQp$vR2nL8xZ@'. That's 16 characters from a pool of 94, giving ~105 bits of entropy. At a billion guesses per second, cracking it would take roughly 40 undecillion years — far longer than the universe has existed. Compare to 'Summer2024!' — 11 characters but easily cracked in minutes by dictionary attacks.
A 20-character password from all sets: ~131 bits of entropy. Crack time exceeds the heat death of the universe. A 12-character password from all sets: ~79 bits — secure for most purposes, crack time ~28 trillion years at 1 billion guesses/sec.
Methodology and sources
This generator uses the Web Crypto API's crypto.getRandomValues() function, which provides cryptographically secure random numbers from the operating system's entropy source. This is fundamentally different from Math.random() in JavaScript, which uses pseudo-random algorithms that can be predicted.
Entropy calculation: log2(characterSetSize^length). For 16 characters from 94 possible characters: 16 x log2(94) = 16 x 6.55 = 105 bits. Each bit doubles the search space, so 80 bits = 2^80 = 1.2 x 10^24 possible passwords.
Crack time assumes 1 billion guesses per second (high-end GPU attack). At this rate: 60-bit entropy = ~36 years; 80-bit = ~38 million years; 100-bit = ~40 billion years. Even at 1 trillion guesses/sec (nation-state), 100-bit passwords remain uncrackable.
Recommendations: NIST Special Publication 800-63B (Digital Identity Guidelines) recommends: minimum 8 characters (we recommend 12+), no composition requirements (we offer options for sites that require them), no mandatory rotation (we agree), screening against common passwords.
Sources: NIST SP 800-63B; xkcd 936 (Password Strength); EFF Diceware passphrase guide.
Industry benchmarks
Password strength benchmarks:
- Minimum acceptable: 12 characters, all character sets (~79 bits)
- Strong: 16 characters, all sets (~105 bits) — recommended for important accounts
- Very strong: 20 characters, all sets (~131 bits) — recommended for password manager master
- Paranoid: 25+ characters, all sets (~164 bits) — for cryptocurrency wallets, high-value targets
- Passphrase alternative: 5+ random words (~100 bits) — easier to type and remember
For comparison: 4-digit PIN = 13 bits (instantly crackable). 6-character lowercase password = 28 bits (crackable in seconds). 8-character password with all sets = 52 bits (crackable in hours).
Common mistakes to avoid
Mistake 1: Reusing passwords. If one site is breached, attackers try those credentials on other sites. Use unique passwords everywhere — password managers make this feasible.
Mistake 2: Using dictionary words with substitutions. 'P@ssw0rd1!' looks complex but is in every cracking dictionary. Substituting @ for a, 0 for o, 1 for l doesn't fool modern crackers.
Mistake 3: Personal information in passwords. Names, birthdays, addresses, pet names — all are easily found on social media. Never use personal info in passwords.
Mistake 4: Keyboard patterns. qwerty, 123456, asdfgh — these are in every cracking dictionary and are among the most common passwords.
Mistake 5: Storing passwords in browser autofill. Browser autofill is convenient but vulnerable to malware and physical access. Use a dedicated password manager with encryption.
Mistake 6: Using the same password for email and other accounts. Email is the master key — if compromised, attackers can reset passwords for every other account. Use your strongest unique password for email.
Mistake 7: Sharing passwords via email or text. Use a secure password sharing feature in password managers, or share temporarily and then change the password.
When to use this calculator
Use this generator whenever creating a new password: new account, password rotation, security upgrade. Generate unique passwords for every account and store them in a password manager.
For password manager master passwords, consider a passphrase (5+ random words) instead — easier to type and remember, similar entropy. For accounts you must memorize (email, master password), prioritize memorability over maximum complexity.
For shared accounts (team passwords, streaming services), generate strong passwords and share via password manager's sharing feature, not email or chat.
Related metrics and alternatives
Passphrase generators: Generate 4-6 random words instead of random characters. Easier to remember, similar security. EFF Diceware is the standard.
Password managers with generators: Bitwarden, 1Password, KeePass, LastPass include built-in generators. Most convenient — generate and store in one step.
Hardware security keys: YubiKey, Google Titan replace passwords entirely for supported sites. Most secure option but requires compatible sites.
Biometric authentication: Face ID, Touch ID, Windows Hello supplement (not replace) passwords. Convenient but not a complete solution.
One-time passwords (TOTP): Google Authenticator, Authy generate time-based codes for 2FA. Add a second factor to your strong password.
How to interpret the results
Entropy < 60 bits: Weak. Crackable in under a year with consumer hardware. Upgrade to longer password.
Entropy 60-80 bits: Moderate. Crackable in years with dedicated hardware. Acceptable for low-value accounts, not for email or banking.
Entropy 80-100 bits: Strong. Crack time exceeds human lifetime. Suitable for most accounts.
Entropy 100+ bits: Very strong. Crack time exceeds age of universe. Suitable for password manager master, email, banking, cryptocurrency.
Entropy 130+ bits: Paranoia level. No realistic attack possible. Overkill for most users but appropriate for high-value targets.