gizmobench

Strong Password Generator

This page opens at 16 characters, and with all four character sets on that is about 105 bits of entropy: past the point where an attacker holding a stolen password file could grind through the possibilities. The draw comes from your browser's own cryptographic generator, in this tab, and the readout prints the bits and the size of the pool they came from so the word strong is a number here rather than a claim. Move the length or turn a set off and the figure moves with it, immediately.

ReadyYour password appears here

Drawn in this tab the moment the page is ready

Type
Length
Include
Entropy
waiting
Strength
waiting
Pool
94 characters
Look-alikes

The length box takes any number from 4 to 128, so an 8, a 12 or a 16 character rule is one keystroke away. Turning a set off drops it from the pool and lowers the entropy shown; excluding look-alikes removes 6 characters (0 O 1 l I |) for a password you have to read off a screen and type somewhere else.

Made here, kept here. Every character is drawn from crypto.getRandomValues on your own device by rejection sampling, so no position in the alphabet is favoured. The result is not sent anywhere, does not enter an analytics event and is never written into a link, and the only thing this page remembers between visits is your settings. It cannot know the rules a particular site enforces, so check its length limit and which symbols it accepts before you save one.
Accuracy. Passwords and passphrases come from the browser's own cryptographic randomness, made on your device and never sent anywhere. The strength shown is the real entropy of the choices you made. It cannot know a site's own password rules.

Common questions

What makes a password strong?
Two things, and neither of them is a special character in the middle. The first is the size of the pool each character is drawn from: all four sets on is 94 characters. The second is how many characters there are. Multiply the one by the other in logarithms and you get the entropy in bits, which is what the readout shows. Sixteen characters from 94 is about 105 bits, and this tool calls anything at or above 80 bits very strong because that is past what an attacker can enumerate offline. A short password decorated with an exclamation mark is not strong: it is a short password.
Is 16 characters overkill?
Not for anything that matters, and it costs you nothing when a password manager or your browser is doing the typing. Twelve characters from all four sets is about 78 bits and is a reasonable floor. Sixteen is about 105 bits and is where more length stops buying anything measurable, which is why this page opens there. If a site caps the length below that, lower the number in the length box: the entropy figure will show you exactly what the cap costs.
Should I include symbols?
Include them where the site allows them, because they take the pool from 62 characters to 94 and every character then carries more. Some sites reject some punctuation, and none of them publishes the rule anywhere a browser could read, so if a password is refused turn the symbols set off and add a character or two of length instead. The readout will tell you what the trade costs: at 16 characters, dropping symbols takes you from about 105 bits to about 95, which is still very strong.
Does the password go anywhere?
No. It is drawn in this tab from crypto.getRandomValues, it is not uploaded, not logged, not put into an analytics event and never written into the address bar, so it cannot leak through a shared link. Only your settings are remembered in this browser, and the saved record is rebuilt from a fixed list of options so a generated value cannot reach storage even by accident.
How do I avoid characters I cannot read off the screen?
Switch look-alikes to Exclude. That removes zero and capital O, one and lower case L and capital I, and the pipe, which are the six characters people mistype when copying a password onto a television, a games console or a printed card. The pool drops from 94 characters to 88, so at 16 characters the entropy goes from about 105 bits to about 103: a cost worth paying when you are typing the thing by hand.

Passwords and passphrases come from the browser's own cryptographic randomness, made on your device and never sent anywhere. The strength shown is the real entropy of the choices you made. It cannot know a site's own password rules.