Password generator

Password strength is measured in bits of entropy — the base-2 logarithm of how many equally likely passwords the generator could have produced.

random: entropy = length × log₂(alphabet size) passphrase: entropy = words × log₂(wordlist size)

Length beats complexity

A 20-character lowercase-only password carries 94 bits. A 10-character password using every symbol on the keyboard carries 65. Adding characters multiplies the search space far faster than adding character classes does — which is why every modern guideline, including NIST SP 800-63B, favours length and has dropped mandatory complexity rules.

Passphrases

Randomly chosen words are memorable and long. The critical word is randomly: a phrase you invented yourself carries far less entropy than the word count suggests, because human word choice is highly predictable. This generator picks each word with the CSPRNG.

Note that this uses a 256-word list, so each word contributes 8 bits. Standard EFF diceware uses 7,776 words at 12.9 bits each — five diceware words give about 65 bits, six about 77.

Reading the crack time

The estimate assumes an offline attack against a fast hash at a trillion guesses a second. It does not apply to a well-implemented site using bcrypt or Argon2 with rate limiting, where the realistic rate is many orders of magnitude lower. It also assumes the attacker knows your generation scheme, which is the conservative assumption.

Reuse is the real risk

Most account compromises come from credential stuffing — a password leaked from one breached site tried everywhere else. A unique password per site, stored in a password manager, plus multi-factor authentication, matters far more than the last ten bits of entropy.