Generate a strong, random password using a cryptographically secure method (the Web Crypto API), entirely inside your browser — nothing is sent anywhere. Adjust the length and choose which character types to include (uppercase, lowercase, numbers, symbols).
Each added character type and length increment multiplies the number of possible combinations, making a password exponentially harder to guess or brute-force. A short, all-lowercase password can be cracked in seconds by modern hardware; a long password mixing uppercase, lowercase, numbers, and symbols can take centuries.
A 16-character password using only lowercase letters (26 possibilities per character) has 2616 possible combinations. Adding uppercase, numbers, and symbols (roughly 90 possibilities per character) raises that to 9016 — trillions of times more combinations for the same length.
| Password type | Length | Approx. time to crack* |
|---|---|---|
| Lowercase only | 8 characters | Minutes |
| Mixed case + numbers | 12 characters | Years |
| All character types | 16 characters | Centuries+ |
*Rough estimates for offline brute-force attacks; actual time depends on the attacker's hardware and the site's security measures.
This password never leaves your browser — it's generated locally using the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number source, rather than a predictable pseudo-random function. Nothing is sent to any server.
Password strength is primarily a function of entropy — the number of possible combinations an attacker would need to try to guess it. Entropy depends on both the length of the password and the size of the character set used (lowercase, uppercase, numbers, symbols).
A 12-character password using lowercase, uppercase, numbers, and symbols (94 possible characters) has entropy of about log₂(94) × 12 ≈ 78.7 bits — meaning an attacker would need to try, on average, half of 2⁽⁷⁾⁵ⁿ combinations to guess it by brute force.
| Length | Lowercase only (26) | Mixed case + numbers (62) | Full set incl. symbols (94) |
|---|---|---|---|
| 8 | 37.6 bits | 47.6 bits | 52.4 bits |
| 12 | 56.4 bits | 71.4 bits | 78.7 bits |
| 16 | 75.2 bits | 95.3 bits | 104.9 bits |
Is a long passphrase better than a short complex password? Often yes — a passphrase of several random unrelated words can have higher entropy and be easier to remember than a shorter string of mixed symbols.
How often should I change passwords? Modern guidance generally favors strong, unique passwords per account over frequent forced changes, changing mainly in response to a suspected breach.
Are password managers safe to use? Reputable password managers use strong encryption and are generally considered far safer than reusing or writing down passwords, since they only require remembering one master password.
Why do sites limit password length or block certain symbols? Legacy systems sometimes impose outdated restrictions; when possible, favor sites that allow long passwords and a full range of symbols, since these limits can weaken achievable security.
Does adding a number or symbol at the end of a common word make it secure? No — predictable patterns like "Password1!" are among the first guesses in dictionary-based attacks, since attackers account for common substitutions and suffixes.
What is a brute-force attack, and how does length defend against it? A brute-force attack tries every possible combination systematically; because possible combinations grow exponentially with length, each additional character makes brute-forcing dramatically more time-consuming.
Should I use the same strong password for multiple low-risk accounts? It's not recommended — even low-risk accounts can be part of a data breach, and reused passwords let a breach on one site expose accounts elsewhere via "credential stuffing" attacks.
Entropy: A measure of password unpredictability — more character variety and length means higher entropy.
Brute-force attack: An attack method that tries every possible combination until the correct password is found.