Strong Password & Passphrase Generator
Generate random passwords or memorable passphrases in your browser using the Web Crypto API, with an entropy score and estimated time to crack — nothing is sent anywhere.
| Strength | — |
|---|---|
| Possible combinations | — |
| Time to crack — online attack (1,000 guesses/s) | — |
| Time to crack — offline, fast hash (10 billion guesses/s) | — |
Click any password to copy it.
In short
Password strength is entropy in bits: length × log₂(pool size). A 16-character password from letters, digits and symbols has about 103 bits; a 12-character one about 77 bits; a 6-word passphrase from a 536-word list about 61 bits. Anything above 80 bits is out of reach of offline attacks at 10 billion guesses per second.
Who this is for: Anyone who needs a strong random password or a memorable passphrase, and wants to see how strong it really is.
What makes a password strong
Strength is measured in bits of entropy: length × log₂(size of character pool) for a random password, or words × log₂(word-list size) for a passphrase. Every extra bit doubles the number of guesses an attacker needs on average.
- A 12-character password from all four sets (pool of 86) has about 77 bits — around 1023 combinations.
- A 16-character one has 103 bits; that is the level most security guidance now recommends for anything important.
- A 5-word passphrase from this 536-word list plus a number has about 52 bits — easier to type on a phone and to remember, and adequate with two-factor authentication. Six words give 61 bits; seven give 70.
The crack-time estimates assume an attacker who can try every combination and who finds the password halfway through on average: 1,000 guesses/second for an online login form with rate limiting, and 10 billion/second for an offline attack on a leaked database using a fast hash like MD5 or SHA-1. Sites that hash with bcrypt, scrypt or Argon2 slow the offline number down by a factor of 10,000 or more.
See also: QR Code Generator — WiFi, WhatsApp, vCard, URL, WCAG Colour Contrast Checker.
Assumptions
- Characters and words are chosen with crypto.getRandomValues using rejection sampling (no modulo bias).
- Entropy = length × log₂(pool) for passwords; words × log₂(536) + log₂(100) for passphrases (one random 0–99 number is appended).
- Crack-time = 2^(bits−1) guesses at 1,000/s (online) or 10¹⁰/s (offline fast hash).
Worked example
Pool = 26 + 26 + 10 + 24 = 86 characters → entropy = 16 × log₂(86) ≈ 103 bits ≈ 1.1 × 1031 combinations.
Offline at 10 billion guesses a second: 5.5 × 1020 seconds ≈ 14 trillion years. Online at 1,000/s: effectively forever.
Frequently asked questions
Is a passphrase really as good as a random password?
Bit for bit, yes — the maths does not care whether the pieces are characters or words. A 6-word passphrase (about 61 bits from this list, or 77 bits from the 7,776-word Diceware list) is stronger than most 10-character passwords and far easier to type correctly.
Should I use the same strong password everywhere?
No. One breach then exposes every account. Use a password manager, generate a different password per site, and turn on two-factor authentication where offered.
Can this page see the passwords it generates?
No. Generation happens in your browser's JavaScript using crypto.getRandomValues; the page has no analytics on the result and makes no request containing it.
Why avoid look-alike characters?
0/O and 1/l/I are easy to confuse when reading a password off paper or a screen. Excluding them costs less than one bit of entropy per character.
How long should a password be in 2026?
At least 12 random characters from all character sets (about 77 bits), or 16 for anything important; with a passphrase, six or more random words.
Is a 4-word passphrase enough?
From a small word list, no — about 40 bits. Use five or six words, or a larger list such as the 7,776-word Diceware list.
Related calculators
Found an error? Report it — tell us the inputs, the result you got, what you expected and the rule or source. Confirmed corrections are published within a week.
Ready to build your next digital solution?
Send the brief and you get a scoped response with approach, milestones and a fixed price range. Not a sales call.
A 30-minute call with the engineer who would run your project
Within 2 business daysA written scope: approach, module breakdown, milestones, fixed price range
Within 5 business daysYou decide. No retainer, no obligation, and the scope document is yours to keep either way
Your timelineSend your brief
Three fields to start. Add project details if you have them.