Password Generator

What Makes a Password Strong?

A strong password is one that a machine cannot guess in any reasonable time. That depends on two things: how many possible passwords exist given the rules you ask for, and whether the actual value looks anything like a word, date, or pattern an attacker would try first.

Length is the single largest lever. Every extra character multiplies the number of possibilities by the size of the character pool, so an 18-character password with uppercase, lowercase, numbers, and symbols has vastly more entropy than a 10-character one regardless of how "clever" the shorter one looks.

This tool lets you tune exactly that: pick a length, choose which character classes to include, optionally exclude look-alike characters, and toggle requirements such as 'must include an uppercase letter' for sites that mandate them.

Why Password Length Matters

Entropy grows additively with length but multiplicatively with pool size. Adding one character to a pool of 72 possibilities multiplies the attack space by 72; adding two characters multiplies it by over 5,000. That is why 16 characters beats 8 characters that are 'harder' to remember.

NIST's current guidance recommends long passphrases over mandatory complexity gymnastics — but it also reminds us that length only helps if the value is drawn randomly. 'Password1password1password1' is long and still terrible because it is predictable.

Password Entropy Explained

Entropy is the number of 'yes/no' questions needed to identify your password among every password an attacker is willing to try. It is measured in bits: each bit doubles the guessing effort. A 100-bit password requires 2^100 guesses at worst, and even a determined offline attacker with huge resources cannot do that.

This tool shows two kinds of numbers. For generated passwords it knows the exact character pool and reports entropy precisely. For pasted passwords it estimates the pool from the character classes actually used — a reminder that lowercase-only passwords lose most of their advantage, no matter how long.

As a floor for modern accounts, aim for at least 80 bits for low-value logins and 100 bits or more for anything holding money, credentials, or personal data.

Passphrases vs Passwords

A passphrase is a sequence of ordinary words, typically separated by dashes or spaces. Four random words drawn from a 5,000-word dictionary hold about 49 bits of entropy (20 bits each), which is a solid base — and humans can actually type and recall them.

The catch is that word lists are guessable in dictionary order, so the words must be selected randomly, not picked by taste. This tool samples from a curated word list and can add a number and capitalisation so the result dodges classic dictionary attacks.

Use passphrases where you must retype the secret often — Wi-Fi networks, shared vaults, or email accounts you log into from many devices. Use long random passwords when a password manager stores them for you.

How Password Managers Work

A password manager encrypts a vault of credentials with a single master password. Generate long, random, per-site passwords (this tool is built for exactly that) and let the manager autofill them, so you only ever memorise the master secret.

A manager solves the three biggest hygiene problems at once: no password reuse, no human-memorisation limit, and no phishing-by-typing, because the manager checks the domain before filling.

If you create a password with this tool and store it in a manager, keep the master password as a passphrase — easy to type, hard to guess; but never reuse the master anywhere else.

Common Password Mistakes

The classics still dominate breach databases: '123456', 'password', 'qwerty', and autumn + year combinations. Equally fragile are mutated dictionary words like 'P@ssw0rd!' — attackers shortcut them with rules engines that try every common substitution.

Reusing one password across sites is the most damaging habit: one phished or breached password instantly exposes every account. Rotation matters less than uniqueness — a strong unique password never needs to be changed just because a guessing attack could eventually try it.

Finally, truth-in-labels: answers to security questions are public facts masquerading as secrets. Treat them as second passwords and answer them with nonsense only you can reproduce.

How Attackers Crack Passwords

Two attack shapes matter. Online attacks target a live login endpoint and are slow by nature — a few guesses per second — which is why even a 40-bit password often survives. Offline attacks steal a password hash and try billions of predictions per second against it using GPUs and rainbow tables.

Against offline attacks, only entropy is your defense: the hash is compared against a candidate, and the only variable you control is how many candidates the attacker must generate. Bigger pool times longer length simply means more candidates (see the crack-time estimates in the strength panel).

Generated passwords defeat the smarter vector too: 'password-plus-common-substitutions' rule sets burn through human-style guesses in hours, but a truly random value appears nowhere in any wordlist.

Creating Secure API Keys

API secrets are passwords that machines type, so recall is irrelevant — every constraint that helps a human hurts nothing here. Generate dense random strings of 40+ characters using the full symbol set; the API Secret preset (48 characters, every class required, no consecutive duplicates) is a sensible starting point.

Store API keys as environment variables or in a vault, never in client-side code or committed config files. Give keys scopes and expiry, and rotate them on a schedule or on any suspicion of exposure.

Client-side secrets remain risky no matter how they are generated: anything shipped to a browser can be extracted. Use this tool for server-side secrets and device-side WiFi keys, and sign your browser traffic instead.