Most password advice is incomplete.
The guidance you have heard — mix upper and lower case, add a number, include a symbol — addresses only a fraction of what makes a credential secure. The governing quantity is entropy: a mathematical measure of unpredictability. Understanding it changes how you think about every password you create.
The problem is not that people choose weak passwords because they are careless. It is that the mental model most people operate with treats passwords as puzzles — something hard for humans to read — rather than as information-theoretic objects with a measurable resistance to attack. A 10-character string of mixed case, digits, and symbols that follows a memorable substitution pattern (P@ssw0rd!) has far less practical entropy than a truly random 12-character string of lowercase letters, because an attacker with a rule-based cracker will find the pattern in minutes.
Length, drawn from a sufficiently large character pool, is the primary driver of strength. Everything else is secondary. This site applies that principle throughout.
How this site differs from others. Rather than leading with a quick-generate slider, we lead with the reasoning. The instrument below shows entropy in bits as you adjust parameters, so you understand what you are producing, not just how long it is.
How credentials get compromised
Understanding the attack surface shapes what a good defense looks like. These are the five vectors that account for the overwhelming majority of account compromises.
Credential stuffing
Automated testing of username/password pairs from previous data breaches. If you reuse a password across sites, one breach exposes all of them.
Offline brute-force
Leaked password hashes cracked with GPU rigs running billions of guesses per second. A 40-bit password falls in seconds; 80 bits is infeasible at current hardware.
Phishing
Fake login pages that capture your credentials in real time. No password strength helps here. Hardware keys (FIDO2) are the only reliable counter-measure.
Dictionary attacks
Exhaustive testing of common passwords, words, and rule-based mutations (P@ssw0rd, password1, etc.). Affects any password with a guessable structure.
Keylogging
Malware that records keystrokes. Mitigated by good endpoint hygiene, a password manager that auto-fills without you typing, and hardware-backed MFA.
The defence stack. A strong, unique password is the foundation. A password manager enforces uniqueness at scale. A hardware security key eliminates phishing. Together they address all five vectors above.
Generate a cryptographically secure credential
All generation uses window.crypto.getRandomValues(). Nothing is transmitted. The entropy figure updates live as you adjust parameters.
crypto.getRandomValues() with rejection sampling to eliminate modulo bias.
Read the full entropy explainer for the mathematics behind these figures and how they compare across attack scenarios.
Choosing a password strategy
Three approaches dominate practical password security. Each has different trade-offs between entropy, memorability, and operational overhead.
Random password
- Highest entropy per character
- Not human-memorable
- Requires a password manager
- Ideal for most account types
Passphrase
- Human-readable and typeable
- Good entropy at 7+ words
- Works well for master passwords
- Longer to type but easier to recall
Password manager generated
- Enforces uniqueness per site
- Auto-fills — you never type it
- Centralises risk to one master credential
- Use with a hardware key for the master
| Property | Random password | Passphrase | Manager-generated |
|---|---|---|---|
| Entropy (typical) | 80 – 130 bits | 62 – 90 bits | 80 – 130 bits |
| Human-memorable | No | Yes (short-term) | No |
| Unique per account | Manual effort | Manual effort | Automatic |
| Phishing resistant | No | No | No (use hardware key) |
No password alone defeats phishing. That requires a hardware FIDO2 key or a passkey stored on a physical device. See the hardware section below for recommendations.
Physical security for digital accounts
Software passwords solve half the problem. Hardware tokens, encrypted storage, and physical security devices address the vectors — phishing, device theft, side-channel attacks — that passwords cannot.
Categories to consider: FIDO2 / U2F security keys eliminate phishing for supported accounts. Hardware wallets keep cryptographic keys air-gapped. Encrypted USB drives carry sensitive files without risk if physically lost. Privacy screen filters prevent shoulder surfing. Router and network hardware with modern firmware closes home-network attack surfaces.
Hardware picks are refreshed weekly. Check back soon.
Common questions
The most frequent questions about password entropy, passphrases, and hardware security.
What is password entropy and why does it matter?
Entropy is an information-theoretic measure of unpredictability, expressed in bits. For a password generated by choosing each character independently and uniformly from a pool of size N, entropy is log2(N) multiplied by the length. A higher bit count means an attacker must try more combinations to crack the password by brute force.
It matters because it gives you an objective number to compare approaches. Complexity rules ("must contain a symbol") do not change the pool size enough to matter; length increases do.
How long should a password be in 2026?
For a fully random password drawn from mixed characters (uppercase, lowercase, digits, symbols — ~95 characters): 16 characters yields about 105 bits, which is considered very strong at current cracking speeds. For accounts where a breach would be catastrophic, 20 characters (131 bits) is a sensible floor.
For a passphrase, 7 words from this tool's 480-word list gives about 62 bits — adequate for most purposes. 9 words gives 80 bits — a robust choice for a master password.
Is a passphrase stronger than a random password?
Not at equal character count. A random password drawn from a 95-character pool packs more entropy per character than a passphrase drawn from a word list. However, a sufficiently long passphrase (8-10 words) matches or exceeds a typical 12-14 character random password in entropy, while being far easier to memorise and type — which is why passphrases are recommended for master passwords you cannot store in a manager.
What is a FIDO2 security key and do I need one?
A FIDO2 key is a physical device that stores a private cryptographic key and performs authentication via a challenge-response protocol bound to the origin domain. Because it verifies the actual domain at the hardware level, it cannot be tricked by a phishing page — even a pixel-perfect replica of your bank's login will not receive a valid response from the key.
For high-value accounts (email, bank, cloud storage), a hardware key is the most significant security improvement available. Password managers and strong passwords protect against brute force; hardware keys protect against phishing, which is where most credential theft actually occurs.
Are my passwords sent anywhere when I use this tool?
No. Generation runs entirely inside your browser. This page makes no network requests during generation, the randomness comes from window.crypto.getRandomValues() (the Web Crypto API), and there is no server-side component. Close or navigate away and the generated password is gone — it is never written to storage, logged, or transmitted.
Should I use a password manager?
Yes. The single most effective security behaviour for most people is using a password manager with a unique, strong password for every account. Password managers enforce uniqueness automatically, meaning one compromised site cannot cascade to others.
The master password for your manager should be a long passphrase (9+ words) that you have memorised. Pair your manager with a hardware security key for maximum protection.
In depth
Technical writing on passwords, hardware security, and the mechanics of credential attacks.
Understanding Password Entropy: The Mathematics of Strong Passwords
The bit-level explanation of why length beats complexity, and how to read an entropy figure against real-world attack scenarios.
Physical Security Keys: A Practical Guide to FIDO2
How FIDO2 keys work, why they defeat phishing when passwords cannot, and how to choose between the main options available in 2026.
How to Create a Strong Password (That You Can Actually Use)
Practical guidance on creating, storing, and managing strong credentials without getting in your own way.
Two-Factor Authentication: What It Is and Why You Need It
A comparison of TOTP, SMS, push notifications, and hardware keys — ranked by actual security, not just convenience.
Password Managers Explained: Are They Safe and Worth It?
The case for password managers, how they store your vault, and what happens if the provider is breached.
How to Spot a Phishing Email: 8 Indicators
The technical and behavioural signals that distinguish a phishing attempt from a legitimate message, with annotated examples.