🔐 Secure Password Generator
Create strong passwords with letters, numbers and symbols. Memorable passphrases, PINs and WiFi keys. Nothing sent to servers, generated 100% in your browser.
🎲 Generator
Strength
—
Entropy: — bits
Time to crack: —
Length
16
📦 Batch generated (10)
Combinations
—
possible
Alphabet
—
characters
Level
—
security
✅ Copied!
What makes a password secure?
A secure password is hard to guess for both humans and automated attacks (brute force, dictionary). Password security depends mainly on two factors:
- Length — Each extra character exponentially multiplies the time to crack it. Minimum 12, ideal 16+.
- Character variety — Combining upper, lower, numbers and symbols expands the attackable "alphabet".
- Randomness — Avoid patterns, common words, names or dates. Use cryptographic generators.
- Uniqueness — Never reuse the same password on multiple sites. If one leaks, all are lost.
Table: Time to crack
Approximate times for an attacker with powerful hardware (10 billion attempts per second):
| Length | Numbers only | Letters + numbers | All characters |
|---|---|---|---|
| 6 | Instant | Seconds | Minutes |
| 8 | Instant | Minutes | Hours |
| 10 | Seconds | Hours | Weeks |
| 12 | Minutes | Months | Thousands of years |
| 16 | Days | Millions of years | Billions of years |
Password security best practices
✅ What TO DO
- Use a password manager — Bitwarden, 1Password, KeePass are safe options.
- Enable 2-factor authentication (2FA) — Double security: password + temporary code.
- Unique password per site — Prevents domino effect if one leaks.
- Change passwords after breaches — Check haveibeenpwned.com if your email was compromised.
- Passphrases — Example: "Correct-Horse-Battery-Staple". Easy to remember, very secure.
❌ What NOT to do
- Use personal info — Name, birthday, pet, city are easy to find.
- Dictionary words — Dictionary attacks try millions per second.
- Obvious substitutions — Replacing "a" with "@" or "o" with "0" no longer fools attackers.
- Share passwords — Never by email, chat or SMS.
- Save in notes — Unencrypted text files are vulnerable.
FAQ
Is this generator safe?
Yes. Passwords are generated 100% in your browser using
crypto.getRandomValues(), the native crypto API. Nothing sent or stored on our servers.How many characters should my password have?
Minimum 12 for general use, 16+ for critical accounts (banking, main email, password manager).
What is a passphrase?
A password made of 4+ random words joined by a symbol, e.g. "oak-cactus-cloud-ocean". As secure as a long password but much easier to remember.
Can I trust a password manager?
Yes. Modern managers (Bitwarden, 1Password, KeePass) use military-grade encryption.
What is password entropy?
Entropy measures randomness in bits. More bits, harder to crack. Under 40 bits: weak. 40-60: OK. 60-80: good. 80+: excellent.
How often should I change passwords?
Periodic mandatory changes are no longer recommended. Change only when: known breach, suspected unauthorized access, or you shared access temporarily.