Password Generator

What makes a password strong

Strength is measured in entropy — bits of unpredictability — and length contributes far more than complexity. Each additional character multiplies the search space by the size of the character pool, so a long password from a small alphabet beats a short one from a large alphabet.

A 16-character password from a 94-character pool carries about 105 bits of entropy, which is beyond brute force with any foreseeable technology. An 8-character password from the same pool has about 52 bits and can be exhausted by a well-equipped attacker in hours. The practical guidance is simple: prefer length.

Why the old complexity rules were wrong

The familiar requirements — at least one uppercase, one number, one symbol, changed every 90 days — came from NIST guidance published in 2003 whose author has since said the advice was mistaken. In practice the rules pushed people toward predictable patterns like Password1! and P@ssw0rd, which attackers model directly.

Current NIST guidance (SP 800-63B) reverses much of it: prioritize length, allow all characters including spaces, screen new passwords against lists of known breached credentials, and do not force periodic rotation without evidence of compromise. Forced rotation reliably produced weaker passwords, as users made minimal predictable changes.

Passphrases as an alternative

A passphrase of several random words can be both strong and memorable. The Diceware method selects words at random from a list of 7,776; each word adds about 12.9 bits, so six words give roughly 77 bits — strong, and far easier to type and remember than a random string.

The critical requirement is genuine randomness in the word selection. A phrase you compose yourself is weak, because human word choice follows predictable patterns and attackers use language models against it. Words drawn by dice or by a cryptographic generator are what produce the entropy.

Practical password security

Reuse is the dominant real-world risk. When any service is breached, attackers replay the credentials against other sites — credential stuffing — so one leaked password compromises every account sharing it. A unique password per account contains the damage to one service.

A password manager is what makes that practical: it generates and stores unique credentials so you only memorize one strong master password. Enable two-factor authentication wherever available, preferring an authenticator app or hardware key over SMS, which is vulnerable to SIM swapping. And treat security questions as additional passwords — mother's maiden name is often public — by storing random answers in your manager.

How long a password survives

The figures below use the calculator's own model: an offline attack against a stolen hash at ten billion guesses a second, with the attacker expected to succeed halfway through the keyspace. A slow password hash such as bcrypt or Argon2 cuts the guess rate by many orders of magnitude; an online login form, which rate-limits attempts, is slower still. Plan for the offline case, because that is how breached passwords are actually cracked.

Reading the strength meter

The meter maps entropy to four bands. The boundaries are conventions rather than physics, but they line up with what current hardware can and cannot exhaust.