Secure Password Generator

How the Entropy Number Should Guide You

The bits shown next to your password come from length × log2(pool size) — a direct measure of how many guesses an attacker would need on average against an offline attack. The number only holds if the password is truly random, which is why this tool samples from the browser cryptographic random number generator instead of Math.random.

Practical thresholds: 40 bits resists casual attacks but falls to a determined adversary; 60–70 bits is a solid floor for online accounts with rate limiting; 80+ bits is the range where offline cracking becomes economically unreasonable. If you must memorize a password, four or five random words give comparable entropy to a random 12-character password and are far easier to recall.

Where Generated Passwords Should (and Should Not) Go

• Password manager: generated passwords are meant to live here — 20+ random characters cost you nothing.
• Account recovery questions: do not reuse generated secrets in a form the support team can read.
• PINs and numeric keypads: generate with digits only, and prefer 8+ digits — 4-digit PINs have under 14 bits.
• Anything you must type on a shared or unfamiliar device: entropy does not help if a keylogger is watching.