Password Generator
Strong passwords, generated on your device.
Strong passwords, generated on your device.
How to use it
- Pick a length. Length matters more than complexity. Twenty characters is comfortably beyond brute force, and longer costs you nothing.
- Choose the character types. The result is guaranteed to contain at least one of each type you tick, rather than merely being drawn from them.
- Copy it straight into your password manager. The line underneath shows how many bits of entropy it carries, which is the number that actually describes its strength.
When you would use this
A password generator is only as good as the randomness behind it, and that is the part you cannot see by looking at the output. This one draws from the browser's cryptographic random source rather than the ordinary one, which is a predictable sequence seeded from the clock and would let anyone who knew roughly when you visited narrow the search enormously. The selection is unbiased too: taking a random byte and dividing by the alphabet size skews the result toward the earlier characters, which is invisible without measuring and is present in a lot of generators. Every character type you tick is guaranteed to appear at least once, rather than merely being possible, so the result is not silently rejected by a site that demanded a digit.
Questions
- Can you see what this generates?
- No. There is no server involved. The page is static files and the randomness comes from your own browser, so there is nothing for anyone to log.
- How long should a password be?
- Twenty characters of mixed types is far beyond what anyone can brute force. Length beats symbol soup: a longer password with fewer character types is stronger than a short cryptic one.
- What does the entropy figure mean?
- It is the base-2 logarithm of how many passwords could have come out. Each extra bit doubles the work to guess it, and anything over 80 bits is not being brute forced by anyone.