A strong password is long, random and unique. Aim for at least 14 characters (20 or more for email and banking), create it with a cryptographic random generator and never reuse it. This generator makes passwords, passphrases and PINs entirely in your browser, shows the entropy in bits and estimates how long an attacker would need to crack it.
How is password strength measured?
Entropy measures how unpredictable a password is, in bits. It equals the length multiplied by log2 of the size of the character set, and every extra bit doubles the number of guesses needed. The crack times below assume an offline attacker making 100 billion guesses per second.
| Example | Entropy | Average time to crack |
|---|---|---|
| 8 random lowercase letters | 37.6 bits | about 1 second |
| 6-digit PIN | 19.9 bits | instantly |
| 5 random words (EFF list) | 64.6 bits | about 4 years |
| 12 random letters and digits | 71.5 bits | about 600 years |
| 16 random characters, all types | 104.9 bits | about 7 trillion years |
Should I use a password or a passphrase?
Use a random character password for the accounts stored in your password manager, where you never have to type it. Use a passphrase of five or more random words for the few secrets you must remember, such as your device login and your password manager’s master password. Words chosen at random from a large list are easy to read and type and still very strong.
What are the best practices for passwords?
- Use a different password for every account, and keep them in a password manager.
- Prefer length over complexity rules. NIST SP 800-63B recommends allowing long passwords and passphrases and advises against forced composition rules and routine password changes.
- Turn on two-factor authentication or passkeys wherever they are offered.
- Change a password only if you suspect it has been exposed.
Is it safe to generate passwords on a website?
Yes, when the generator runs locally. This one uses your browser’s crypto.getRandomValues function, so every character comes from a cryptographically secure source, and the password is never sent over the network or stored. You can view the page source to confirm it.