Password and Passphrase Generator

What "entropy in bits" actually measures

Entropy counts how many guesses an attacker needs in the worst case if they know exactly how your password was made. Each bit doubles the work. A password with 40 bits of entropy has 2^40 possibilities, about a trillion. One with 80 bits has a trillion times a trillion, roughly. The formula is short: bits = length × log2(pool size) for a random password, and bits = words × log2(list size) for a passphrase.

This only works when the choices are truly random. "Password@2026" looks like it has 13 characters from a 94-character pool, but a cracking tool tries it within the first few thousand guesses, because a human picked it. The tool uses crypto.getRandomValues, the browser's cryptographic generator, and picks each character with rejection sampling: any random number that would favour some characters over others is thrown away and redrawn. A plain random % n would make early characters slightly more likely.

A worked example, with the numbers

With every character type ticked and look-alikes allowed, the pool is 26 lowercase + 26 uppercase + 10 digits + 23 symbols = 85 characters. log2(85) = 6.409 bits per character.

• 16 characters: 16 × 6.409 = 102.6 bits.
• 12 characters: 76.9 bits.
• 20 characters: 128.2 bits.
• 16 lowercase letters only: 16 × log2(26) = 75.2 bits. Still far stronger than an 8-character password with everything in it (8 × log2(94) = 52.4 bits).

To make that concrete, assume an attacker who has stolen a database of fast, unsalted hashes and can test 10 billion guesses a second. That is a deliberately harsh assumption. On average they find the password after half the space. For 52.4 bits that is about 3.5 days. For 76.9 bits, around 225,000 years. For 102.6 bits, longer than the age of the universe by a wide margin. Past about 80 bits, extra length stops mattering for guessing attacks.

Passphrases need more items for the same strength because each word carries less. The built-in list has 376 words, so each word gives log2(376) = 8.55 bits. Five words are 42.8 bits, which the tool calls Fair and which falls in about six minutes under the same assumption. Eight words are 68.4 bits and rated Strong. A 7,776-word diceware list would give 12.9 bits a word, but a short list means more words you can still remember. Ticking the random-number option adds 6.6 bits.

The labels are rough bands: under 28 bits very weak, under 40 weak, under 60 fair, under 80 strong, and 80 or more very strong.

Mistakes that matter more than length

Reusing one good password. If a small forum you joined in 2019 leaks your password, attackers try that same email and password on your bank, email and shopping accounts. A 128-bit password used twice is a 0-bit password for the second site. Generate one per account and keep them in a password manager. See why strong passwords still get hacked.

Editing the result. Swapping a character for one you like, or shortening a result, removes the randomness you paid for. If a site rejects some symbols, untick symbols and add length instead.

Forced rotation. NIST SP 800-63B advises length over complexity rules and against changing passwords on a schedule. Change one when you have a reason, such as a breach notice.

Skipping two-factor authentication. A password only protects you from guessing. It does nothing when you are phished. Turn on an authenticator app or a passkey for email, banking and UPI-linked accounts first.

Limits of this page

The generator cannot know where you paste the result. A keylogger, a malicious browser extension or a phishing page will capture any password, however strong. The entropy figure assumes the attacker knows your settings, so it is a floor. It does not account for sites that cap length or reject symbols, and the figure slightly overstates the strength of short passwords because each selected character type is guaranteed to appear at least once, which removes a few possibilities. For more on picking and storing passwords, read the strong password guide.

Questions people ask