Strong Password Generator
Passwords are generated on your device with crypto.getRandomValues(), the same cryptographically secure source browsers use for encryption keys. Drag the length slider and watch the crack time move — the jump from 12 to 16 characters is not what most people expect.
Runs entirely in this tab. Nothing is sent, logged or stored — not even in your browser.
Pick a length and character set to begin.
What the crack time actually means
The figure above is the average time to find your password by trying every possibility, at the guess rate of whichever attacker you picked. Average, not worst case — on average you find a randomly chosen password halfway through the keyspace, so the number is half the total.
Switching between the five attackers is worth doing, because the spread is the entire point. The same password can be "instantly" against a breached database hashed with MD5 and "longer than the universe" against a login form that locks out after five tries. The password is not what changed — the attacker did. This is why the site storing your password correctly matters as much as the password itself, and why you have no control over the thing that matters most.
Where these numbers come from
Guess rates are rounded to a clean order of magnitude, because anything more precise would be false precision. Where a range was defensible, the attacker-favourable end was taken — overstating your password's strength is the dangerous direction to be wrong in.
- Login form — 0.1 guesses/sec. A policy limit rather than a hardware one. OWASP ASVS 4.0 asks for no more than 100 failed attempts per hour on an account, and NIST SP 800-63B caps consecutive failures at 100 before the authenticator is disabled. The rate here is set a little above that to allow for throttling that is per-IP rather than per-account, which an attacker with a proxy pool walks straight around.
- Sloppy API — 1,000 guesses/sec. Triangulated from published credential-stuffing telemetry and from what an unprotected login endpoint can physically absorb before it falls over. For reference, the widely used
zxcvbnlibrary still assumes 10/sec for this case, a 2012 figure that is far too generous to the defender today. - Leak, hashed well — 100,000 guesses/sec. From measured hashcat benchmarks for bcrypt on current GPUs, scaled to a realistic multi-GPU rig. Note this is bcrypt at a typical work factor; Argon2id tuned properly is slower still.
- Leak, hashed badly — 1 trillion guesses/sec. From measured hashcat benchmarks: a single RTX 4090 does around 164 billion MD5 hashes a second, and eight of them rented by the hour gets you to a trillion. This is the scenario most "time to crack" displays quietly assume, and the one that actually happens when a database leaks.
- Nation-state — 1 quintillion guesses/sec. The only extrapolated figure, because no such machine has been publicly demonstrated. It is anchored to the Bitcoin network, which sustains roughly 880 exahashes per second of purpose-built SHA-256 silicon — so this scenario is about a thousandth of what humanity has already built for an unrelated purpose.
One assumption runs through all five: that the attacker is guessing uniformly at random and knows nothing about you. That is the right model for a password this tool generated. It is far too kind to a password you invented — see the caveats under "Testing your own password" below.
Length beats complexity, and it is not close
Drag the slider from 12 to 16 and watch what happens. Four extra lowercase characters multiply the search space by nearly half a million. Now untick symbols and see how little you lose by comparison.
This is the single most useful thing the display teaches. Adding a symbol to a 20-character password raises its entropy by about 15%. Adding four more characters raises it by about 20% — and you can actually type it. If a site rejects symbols, shrug and make the password longer.
Where the randomness comes from
Generation uses crypto.getRandomValues(), the browser's cryptographically secure random number generator, not Math.random(). That distinction matters more than it sounds: Math.random() is built to be fast and evenly distributed, not unpredictable, and its future output can in principle be reconstructed by an attacker who observes enough of it. It has no place in anything security-related.
There is a subtler detail too. Turning a random byte into a character with a plain modulo skews the result toward the start of the alphabet, because 256 rarely divides evenly by the pool size. This generator throws away bytes that would land in the uneven remainder and draws again, so every character really is equally likely.
Testing your own password
The "Test your own" tab estimates strength rather than calculating it, and the difference is important. For a password this tool generated, the entropy is exact — we know it was drawn uniformly at random, so the arithmetic is simply correct. For a password a human invented, we have to guess how an attacker would describe it.
So the estimator looks for the cheap descriptions: dictionary words, names, keyboard runs like qwerty, repeated blocks, years, and the predictable letter-to-digit swaps (p@ssw0rd is not meaningfully different from password). It then prices the cheapest complete description of your password rather than pretending every character was random. This is a reduced version of how the zxcvbn library works.
Two honest caveats. The word lists here are small, so a real attacker's dictionary is far larger than ours and the estimate errs optimistic — treat a good score as a floor, not a guarantee. And the estimator cannot know that your password is your dog's name and your wedding year, which is exactly what someone targeting you personally would try first.
Whatever you type stays in this tab. There is no network request, nothing is written to storage, and closing the page discards it. You can verify that in your browser's Network tab, or by disconnecting from the internet and watching it keep working.
What none of this protects you from
Brute force is not how most people actually lose accounts. The common route is credential stuffing: a site you forgot signing up to gets breached, and the attacker tries that same email and password against your bank. Password strength is irrelevant there — reuse is the vulnerability. A unique password per site is what defends against it, which in practice means a password manager, because nobody remembers forty of these.
The second common route is phishing, where you hand the password over yourself. A 40-character random string typed into a convincing fake login page is exactly as compromised as hunter2. Two-factor authentication is what limits the damage, and turning it on does more for your security than any amount of extra entropy.
Frequently asked questions
How long would it take to crack my password?
Switch to the "Test your own" tab and type it — the estimate appears immediately and nothing is transmitted. Then try the different attacker scenarios, because the answer changes by a factor of a trillion depending on how the site you use stored it.
Why does the crack time change so much between attackers?
Because the guess rates differ by about sixteen orders of magnitude. A rate-limited login form allows roughly 100 guesses an hour; a GPU rig against a badly hashed leaked database does 100 billion a second. Same password, wildly different outcome.
Are these crack time numbers accurate?
They are order-of-magnitude estimates based on published GPU benchmark rates, and they are deliberately rounded because false precision here would be misleading. They also assume a pure brute-force attack — a real attacker tries likely passwords first, so a human-chosen password falls much faster than the number suggests.
Is my password sent anywhere when I test it?
No. Both generating and testing happen entirely in your browser, with no network request and nothing written to storage. You can confirm it in your browser’s developer tools, or by disconnecting from the internet after the page loads.
How long should my password be?
Twelve characters is a floor for a low-stakes account, sixteen to twenty a good default. For your email, your bank and your password manager, go longer — you will not be typing those from memory anyway. Drag the slider and watch the number to see why length is the lever that matters.
What does "bits of entropy" mean?
It is how many guesses an attacker needs, expressed as a power of two. Each extra bit doubles that number. Below about 40 bits a password falls to a determined offline attack; above about 80 bits, brute force stops being the realistic threat and phishing or reuse takes over.
Should I use a passphrase instead?
Four or five randomly chosen words is a legitimate alternative and far easier to type on a phone or a TV remote. The catch is that the words must be picked randomly from a large list — words you choose yourself cluster in predictable ways and the estimator here will mark them down accordingly.
Last updated September 19, 2026