Password Generator
Generate one or many strong, random passwords entirely in your browser. Choose the length and character types, then see the entropy in bits and how long each password would take to crack at several realistic attack speeds. Nothing is sent anywhere or stored.
Example: with Password length 16 · Length (typed) 16 · How many passwords 5 → Entropy per password: 103.6 bits.
- Character pool size89 characters
Computed by the calculator below using its default values. Change any input to see your own numbers.
Estimated time to crack (average, brute force)
What makes a password hard to guess
A password’s resistance to brute-force guessing comes down to two things: how many characters are possible at each position (the pool size) and how many positions there are (the length). Every extra character type you allow, and every extra character you add, multiplies the number of possible passwords — which is why length and variety matter far more than clever substitutions like “p@ssw0rd,” a pattern attackers already check first.
How it’s calculated
Entropy (bits) = length × log₂(pool size), where pool size is the sum of the checked character sets (26 lowercase + 26 uppercase + 10 digits + 32 symbols, minus any excluded ambiguous characters). Total possibilities = 2entropy. Average crack time assumes an attacker must search half the space on average: (2entropy ÷ 2) ÷ guesses-per-second, shown at several realistic attack speeds from a throttled login form to offline GPU hardware. Characters are drawn with crypto.getRandomValues, rejecting values that would bias the selection (rejection sampling) so every allowed character has an exactly equal chance.
Crack-time figures are theoretical averages assuming a pure brute-force attack with no known pattern; a leaked password reused elsewhere, or one derived from personal information, can be found far faster regardless of its entropy.
Common mistakes
- Reusing the same password across sites — a breach on one site then unlocks every other account using it, regardless of strength.
- Choosing predictable substitutions (@ for a, 0 for o) — attackers’ dictionaries already include these patterns.
- Picking a short password with symbols instead of a longer one without — length usually beats complexity for a fixed character count.
- Assuming high entropy protects against phishing or reused, leaked credentials — entropy only defends against guessing, not disclosure.
Frequently asked questions
Is this generator actually secure?
Yes. It uses your browser’s crypto.getRandomValues, a cryptographically secure random source seeded from operating-system entropy — the same class of generator used for encryption keys. Nothing is sent over the network: the password is built and shown entirely in your browser, and nothing is stored.
What does the entropy number mean?
Entropy in bits measures how many independent guesses it would take, on average, to find your exact password by brute force: 2^bits total possibilities. A 16-character password using all four character types has around 104 bits of entropy — far beyond what any realistic attack can exhaust.
Should I exclude ambiguous characters?
Excluding characters like I, l, 1, O, and 0 makes a password easier to type or read aloud correctly, which helps if you’re transcribing it by hand. It slightly narrows the character pool, so entropy per character drops a little — the entropy figure updates live so you can see the trade-off.
Why does the crack-time estimate vary so much?
Crack time depends entirely on how fast an attacker can test guesses. An online login form throttled to a few attempts per second is a very different threat than an offline attacker with GPU hardware testing billions of hashes per second. The table shows several realistic attacker speeds side by side so you can see the range.
Does the site store or see my generated passwords?
No. Generation happens entirely in your browser’s JavaScript using local randomness — nothing is transmitted, logged, or saved by NumberBench. Closing or refreshing the page discards it completely, so save it in a password manager if you plan to use it.