How to create a password attackers can’t crack
The strength of a password has very little to do with whether it looks complicated and almost everything to do with how unpredictable it is. Security researchers measure that unpredictability in bits of entropy. Each additional bit doubles the number of guesses an attacker needs, so the difference between a 40-bit and a 60-bit password isn’t 50% stronger — it’s roughly a million times stronger.
This generator builds every result with crypto.getRandomValues(), the browser’s
cryptographically secure random source, and it shows you the entropy in real time so you can
see exactly how strong your choice is before you use it.
Random password
Short, dense strings of mixed characters. Perfect for accounts you save in a password manager and never have to type by hand.
Memorable passphrase
Several random words joined together. Inspired by the Diceware method — strong enough for a master password yet easy to type.
100% local
All randomness and assembly happen in your browser. Your generated secret is never transmitted, logged or stored anywhere.
A worked example
Say you pick a 16-character password using all four character sets (about 94 possible
characters). That’s roughly 16 × log₂(94) ≈ 105 bits of entropy — far beyond what
any current hardware can brute-force. A 5-word passphrase from a large word list lands around
60–65 bits, which is plenty for everyday accounts and much easier to type on a
phone. The live meter above updates with your exact settings so you don’t have to do the maths.
Rules worth following
- Never reuse a password. One breach then unlocks every account that shares it. A manager makes unique passwords effortless.
- Length beats complexity. A long passphrase is stronger and more usable than a short string of random symbols.
- Avoid anything personal. Names, birthdays, pet names and keyboard walks like
qwertyare the first things cracking tools try. - Turn on two-factor authentication. It protects you even if a password is phished or leaked.