Options
For the same gain, adding length beats adding character types.
More settings (character sets, exclusions, batch)
Quotes, backslash and space are left out, because they often break in shells and CSV files.
For passwords you will read aloud or copy by hand. Fewer candidates means slightly less strength at the same length.
For sites that demand an uppercase letter and a digit. Ruling out the combinations that miss a type puts the real strength a little below the figure above — the gap is wider at short lengths.
129.5 bits — Much higher
Nothing here is stored or uploaded. Close the tab and it is gone, so copy what you need first.
Result
Generating…
- Randomness
- crypto.getRandomValues
- Uploaded
- none
- Stored
- none
Strength (calculated)
The scale is entropy in bits. Fine marks are 8 bits apart; the tall rules are the 45 / 60 / 80 boundaries. Past the top of the scale (192) the needle stops at the right edge. The exact figure is shown in the entropy readout above.
How it is calculated: 20 × log₂(89) ≈ 129.5 bits
Assumption: an attacker with a stolen hash trying 1 trillion guesses per second offline. The hashing scheme moves this by orders of magnitude — much longer with bcrypt or Argon2, much shorter with purpose-built hardware. Treat it as a rough calculated figure.
Pick a length and the character types. Randomness comes from the browser’s crypto API (crypto.getRandomValues), drawn without rounding bias. Strength is shown as entropy in bits plus a crack-time estimate with its assumptions stated. Nothing is uploaded or stored.
Questions
Are generated passwords stored?
No. Nothing is sent to a server and nothing is written to browser storage. Reopening the page generates new ones and the old ones cannot be recovered, so copy what you need before closing the tab.
Do I still need a password manager?
This tool only makes them; it does not keep or sync anything. Using a different password per site requires somewhere to put them, so pair this with a password manager or your operating system’s keychain.
Why is reusing a password dangerous?
When one service leaks, that email-and-password pair gets replayed against other sites automatically (credential stuffing). Because it is a replay rather than a search, password length does not help. Using a different password per site avoids it.
Passphrase or password?
It depends on whether you will type it. A passphrase is easier to type and read aloud at the same bit count, but it is longer, so sites with a length cap may reject it. If it only ever lives in a manager, a random string is fine. Both are drawn from the same source of randomness.