What makes a password "strong" in 2026
One thing: entropy. Entropy is the number of bits an attacker would have to guess. The math:
entropy_bits = length × log2(alphabet_size)A 12-character lowercase-only password = 12 × log₂(26) ≈ 56 bits. A 20-character password with all four classes (upper + lower + digits + symbols, ~94 chars) = 20 × log₂(94) ≈ 131 bits. The jump from 56 to 131 bits isn't 2× stronger — it's 2⁷⁵ times stronger. That's the difference between "cracked overnight" and "cracked after the heat death of the universe."
Target bit thresholds
- < 40 bits — weak. Online services with rate limiting might survive; anything dumped to a database is toast.
- 60 bits — the old common recommendation. Fine for low-stakes reused passwords. Not for 2026.
- 80 bits — modern minimum for any account you care about.
- 128 bits — what you want for master passwords, encryption keys, long-lived credentials.
- 256 bits — overkill, but feels nice.
The randomness is real
This tool uses crypto.getRandomValues(), which pulls from your OS's cryptographically secure
pseudorandom number generator (CSPRNG) — the same source Chrome uses for TLS keys and WebCrypto. Not
Math.random(), which is predictable and must never be used for security.
We also use rejection sampling when mapping random bytes to character alphabets, so every
character in the output is uniformly distributed across the alphabet. No subtle bias from naive
% alphabet.length mapping.
Pronounceable mode — when to use it
Pronounceable mode alternates consonants and vowels (CVCVCV...), producing passwords like Mikibopu8!.
Easier to memorize and type, but the effective alphabet shrinks to ~25 chars, so entropy drops ~20%. Use for
passwords you must type by hand (router admin, BIOS password). For everything else, use a password manager
and maximum-strength random.
What this tool does NOT do
- It does not store passwords. Nothing is saved, nothing transmitted. Close the tab, the password is gone.
- It is not a password manager. Use Bitwarden, 1Password, or KeePass to store generated passwords.
- It does not check passwords against the HaveIBeenPwned breach database — since we never see your password, we couldn't anyway.
Crack-time methodology
The displayed crack time assumes an offline attack at 1 trillion guesses/sec, which matches a modern GPU rig cracking a fast-hash target (MD5, NTLM). Against bcrypt or argon2 (what real apps use for password hashing), attackers get 10,000× slower, so a password with 60-bit entropy that cracks in "1 day" against MD5 takes ~27 years against bcrypt. Either way: more entropy = exponentially better.
Frequently asked questions
Is the generated password unique?
At 80+ bits of entropy, the probability of collision across all humans ever is vanishingly small. At 128 bits, it's not a thing that happens.
Why exclude ambiguous characters?
Characters like 0/O, 1/l/I, and |// look identical in many fonts. Excluding them reduces errors when passwords must be typed or transcribed. Costs ~1-2 bits of entropy — negligible.
Can I use this for encryption keys?
For human-entered passphrases that derive keys via PBKDF2/scrypt/argon2, yes. For raw encryption keys (AES-256, etc.), use proper key generation: crypto.subtle.generateKey() or equivalent — those must be raw bytes, not alphabet-restricted strings.
Bulk mode — what's it for?
Generating temporary passwords for multiple accounts at once (e.g., pre-generating for team onboarding, or seeding test data). Generates up to 100 at a time.
Is this really offline?
Yes. After the page loads, you can disconnect from the internet. The CSPRNG lives in your browser.
Related tools
- Base64 Encoder / Decoder — Encode and decode Base64 strings and files. Client-side, safe for sensitive data.
- UUID Generator — Generate UUID v4 and v7 identifiers in bulk.
- Hash Generator — Generate MD5, SHA-1, SHA-256, and SHA-512 hashes client-side.
- QR Code Generator — Generate QR codes for URLs, text, Wi-Fi, contact cards. Custom size, colors, error correction. Download as PNG or SVG. 100% client-side.
Pillar
Part of Encoding & Crypto.
Written by Mian Ali Khalid. Last updated 2026-04-25.