Password Generator
The password is created in your browser and never sent anywhere. You can see how many possibilities it was drawn from and how long it would take to guess.
In shorta strong password is not one that looks complicated but one drawn at random from a large set. Twenty-four characters across both letter cases, digits and symbols give about 155 bits of entropy — guessing it on a GPU cluster would take longer than the universe has existed. A password with a word and a year, like Password2024!, is long on paper and guessed instantly.
Copied
How long it would take to guess
Order-of-magnitude estimate for a fast hash — the worst case for you. If the service stores passwords properly, guessing takes longer.
How entropy grows with length
Standards compliance
Only requirements on the password itself are checked. Anything about server-side storage — hashing algorithm, salt, attempt limits — cannot be seen from a browser, and we do not pretend otherwise.
Advanced
What to include
What to include
Several at once, pick one
Twelve passwords using the current settings. The dot on the left is the strength rating; it can differ when characters of one class happen to land together.
Check your own password
The analysis runs on your device. The password is not transmitted or stored. A pasted password is analysed against a dictionary of breached and common words, which accounts for names, dates and keyboard runs that a character-class formula cannot see.
Only the first five characters of the SHA-1 hash are sent — the password cannot be reconstructed from them.
Checked against Have I Been Pwned. Only lawful breach databases with anonymised data are used. Lookup services that trade in phone numbers, emails or documents are neither integrated nor recommended — they are illegal.
Compare two passwords
Not two numbers side by side but where the difference comes from: length, character set, or one of them containing a dictionary word. The analysis runs on your device.
Password policy builder
Assemble the requirements and see, instead of a score, the weakest password the policy will accept. A policy guarantees exactly its minimum, not what disciplined employees happen to type.
Mandatory requirements
History
By default the history lives until you close the tab. Persistent storage is readable by any script on this domain — enable it only on your own device.
Frequently Asked Questions
How long should a password be?
From 16 characters for ordinary services and from 24 for email, banking and anything that restores access to everything else. Length matters more than the character set: each added character multiplies the possibilities, while adding symbols to a short password gains far less.
Is the password generated on a server?
No. Everything runs in the browser through the Web Crypto API; the password is never sent or stored. The only network request is the breach lookup, and it carries the first five characters of a SHA-1 hash — the password cannot be reconstructed from them.
Why is a password like Password2024! considered weak?
Because strength comes from the number of possibilities to try, not from length. A dictionary word and a year are tried first from lists, so a formal 85 bits become an effective 20 and guessing takes an instant. Substitutions such as a→@ and o→0 are known to crackers and add nothing.
What are bits of entropy?
A measure of how many possibilities the password was drawn from: each bit doubles the count. A 60-bit password comes from roughly 10^18 possibilities, a 128-bit one from 10^38. Rule of thumb: below 60 bits is weak for anything valuable, 80 and above covers almost everything that does not guard money.
Is a passphrase safer than a random password?
At equal entropy they are the same, but a passphrase is easier to remember. Five words from a 7776-word list give 65 bits, six give 78. What matters is that a program picks the words: a phrase invented by a person is almost always a predictable quotation or a set expression.
Can one password be reused across sites?
No. One service leaking then means all of them leaked: replaying stolen email-and-password pairs against other sites takes minutes and is fully automated. Distinct passwords in a password manager solve this far better than making one password complicated.