What makes a password strong
Strength is measured in bits of entropy — the number of guesses an attacker would need, expressed as a power of two. It depends on just two things: how many characters are in the pool you draw from, and how many characters long the password is.
- pool
- How many distinct characters could appear at each position
- length
- How many characters long the password is
A 12-character password using all four character types draws from a pool of 94, giving about 79 bits. Adding one character adds 6.6 bits; adding symbols to a letters-and-digits password adds about 0.5 bits per character. Length wins decisively over complexity.
Why this generator is safe to use
Passwords here are generated with crypto.getRandomValues(), the browser's cryptographically secure random number generator. It is designed so that observing past output tells an attacker nothing about future output.
The alternative, Math.random(), is not secure — it is seeded predictably and its output can be reconstructed. Any password tool built on it should be avoided.
Generation happens entirely on your device. The password is never sent over the network, never logged, and disappears when you close the tab.
What current guidance actually says
NIST Special Publication 800-63B, the standard most security teams follow, reversed much of the old advice. It now recommends:
- Allow long passwords — at least 64 characters — and do not truncate them.
- Do not force periodic changes. Change passwords only on evidence of compromise.
- Do not impose composition rules like "must contain a symbol". They push people toward predictable substitutions such as P@ssw0rd1.
- Do screen new passwords against lists of known breached passwords.
- Allow paste, so password managers work.
The reasoning is behavioural. Forced complexity and rotation produce weaker passwords in practice, because people respond with predictable patterns.
| Password | Entropy | Time to crack |
|---|---|---|
| 8 chars, lowercase only | 37.6 bits | Under a minute |
| 8 chars, all types | 52.4 bits | About 1 hour |
| 12 chars, all types | 78.7 bits | About 130,000 years |
| 16 chars, all types | 104.9 bits | Longer than the universe has existed |
| 4 random common words | 51.7 bits | About 40 minutes |
| 6 random common words | 77.5 bits | About 60,000 years |
Frequently asked questions
Are these passwords really random?
Yes. They use crypto.getRandomValues(), the browser's cryptographically secure generator, which draws from the operating system's entropy pool. This is the same class of randomness used to generate encryption keys.
Is it safe to generate a password on a website?
It depends entirely on whether generation happens in your browser or on a server. Here it is local — you can disconnect from the internet and the generator still works.
A tool that sends your password over the network, or that could log it server-side, should not be trusted. If you cannot tell which a tool is, use your password manager's built-in generator.
How long should a password be?
At least 16 characters for anything meaningful, and 20 or more for email, banking and password-manager master passwords. Your email account is the most important one, because it can reset everything else.
Are passphrases better than random passwords?
They are easier to remember and can be equally strong if you use enough words chosen randomly. Six random words from a 7,776-word list gives about 77 bits — comparable to a 12-character random password.
The catch is that the words must be chosen randomly, not by you. Human-chosen word sequences are far more predictable than they feel.
Should I change my passwords regularly?
Current NIST guidance says no — change them when there is evidence of compromise, not on a schedule. Forced rotation makes people choose weaker, more predictable passwords.
What matters more is that every account has a different password, and that important accounts have two-factor authentication.