Password Generator – Secure, Free, Browser-Based

Password Strength, Entropy, and Security Best Practices

A strong password is not just a long one — it is an unpredictable one. Password strength is formally measured in bits of entropy, which quantifies how many guesses an attacker would need to crack it by brute force. Each additional character multiplies the search space: a password drawn from a 94-character set (uppercase + lowercase + digits + symbols) adds about 6.6 bits of entropy per character. That means going from 8 to 16 characters roughly doubles the entropy and squares the cracking time. At 128 bits of entropy — achievable with a 20-character random password using the full character set — even the fastest modern hardware would take longer than the age of the universe to crack by brute force.

What actually gets passwords cracked is not brute force — it is reuse, dictionary attacks, and data breaches. Have I Been Pwned currently indexes over 12 billion breached accounts. Using a unique, randomly generated password for every site means that a breach of one service exposes nothing else. Pair that with a password manager (which removes the human memory bottleneck) and you get strong, unique passwords everywhere with no cognitive load. This generator uses crypto.getRandomValues(), the same cryptographic RNG your OS uses for TLS key generation, so the output is genuinely unpredictable.

Length	Character Set	Entropy (bits)	Strength
8	Lowercase only (26)	~37.6	Very Weak
8	Alphanumeric (62)	~47.6	Weak
12	Alphanumeric (62)	~71.4	Moderate
16	Alphanumeric (62)	~95.3	Strong
16	Full ASCII (94)	~105.1	Strong
20	Full ASCII (94)	~131.4	Very Strong
24	Full ASCII (94)	~157.6	Extremely Strong

Worked Examples

Example 1 — Calculating entropy for a 16-character password
With uppercase (26) + lowercase (26) + digits (10) + symbols (32) = 94 characters in the pool. Entropy = log₂(94¹⁶) = 16 × log₂(94) = 16 × 6.555 ≈ 104.9 bits. At 10 trillion guesses per second (a high-end GPU cluster), exhausting half the search space takes roughly 2 × 10¹⁸ years — effectively uncrackable by brute force.

Example 2 — Why "P@ssw0rd1!" is still weak
Despite containing uppercase, lowercase, digits, and symbols, "P@ssw0rd1!" is a predictable substitution pattern. Dictionary attacks include common leet-speak transforms (a→@, o→0, s→$) and these variants appear in breach databases. Entropy based on the character set is misleading when the actual selection method is predictable. A random 12-character password from the same character set has orders of magnitude more effective entropy.

Frequently Asked Questions

What makes a password strong?

True randomness and sufficient length. A strong password is generated randomly from a large character set — not chosen by a human, not based on words or patterns, not reused across sites. NIST's current guidance (SP 800-63B) recommends at least 8 characters for user-chosen passwords but emphasizes that longer random passwords are far more secure. Unpredictability, not complexity rules, is what matters.

How long should a password be?

For high-value accounts (email, banking, password manager master password), aim for 16–20 characters minimum from a full character set. For lower-stakes accounts managed by a password manager, 12–16 random characters is excellent. The gain from going beyond 20 characters is mostly theoretical; the bigger win is ensuring every account has a unique password.

Should you always use special characters?

Special characters increase the character pool size and thus entropy, but only if chosen randomly. Some sites block certain symbols in passwords — a frustrating but real limitation. If a site only allows alphanumeric characters, compensate by increasing the length: a 20-character alphanumeric password has comparable entropy to a 16-character full-symbol password. Never sacrifice randomness to meet complexity requirements.

What is password entropy?

Entropy, measured in bits, quantifies the unpredictability of a password. It is calculated as log₂(pool_size^length). For example, a 12-character password from a 62-character pool has log₂(62¹²) ≈ 71.4 bits of entropy. Higher entropy means more possible combinations and more guesses needed to crack it. Each additional bit of entropy doubles the cracking time.

Is it safe to use a browser-based password generator?

Yes, when the generator uses the browser's crypto.getRandomValues() API, as this one does. That function draws from the operating system's cryptographically secure random number generator (CSPRNG) — the same source used for TLS keys and certificate generation. The passwords are generated entirely in your browser and never sent to any server. You can verify this by disconnecting from the internet and using the tool — it works identically offline.