Entropy (true randomness) is what makes a password unbreakable. Our secure password generator uses crypto.getRandomValues() (Web Crypto API) — the browser-native CSPRNG — to create passwords and passphrases with measurable entropy in bits, no Math.random(), 100 % on your device.
Two modes: Password vs Passphrase
| Mode | Format | Typical entropy | Best for |
|---|---|---|---|
| Password | xK9#mP2$vL5@ |
80–128 bits (16–24 chars) | Web accounts, apps, databases, API keys |
| Passphrase | correct-horse-battery-staple |
52–90 bits (4–7 words) | Master password (Bitwarden, 1Password), disk encryption (VeraCrypt, LUKS, FileVault), GPG/SSH passphrase |
Golden rule: use passphrase for the master key that unlocks everything else. Use unique random passwords (stored in manager) for each service.
Entropy: bits, not “visual strength”
The “strength” shown by bar meters is security theater. What matters is bits of entropy:
| Entropy (bits) | Resistance to | Example |
|---|---|---|
| < 40 | Trivial (seconds) | password123 |
| 40–50 | Hours/days (online) | Summer2024! |
| 50–60 | Months (online) | Passphrase 3 words |
| 60–70 | Years (online, rate-limited) | Password 14 alphanumeric chars |
| 70–80 | Centuries (online) / days (offline GPU) | Passphrase 4 Diceware words |
| 80–100 | Unbreakable offline (GPU cluster) | Password 20 chars / Passphrase 5 words |
| 100–128 | Long-term secrets (root keys, seeds) | Passphrase 7 words / Password 24+ chars |
Our generator shows exact bits and estimated crack time (online @ 1M/s, offline @ 100B/s GPU).
Wordlists for passphrases
| List | Words | Entropy/word | Recommended use |
|---|---|---|---|
| EFF Long (Diceware) | 7,776 | 12.9 bits | Master password, encryption, GPG |
| EFF Short | 1,296 | 10.3 bits | Shorter, readable passphrases |
| BIP-39 (English) | 2,048 | 11 bits | Crypto seed phrases (12/24 words) |
| Diceware original | 7,776 | 12.9 bits | Classic, compatible |
Separators:
-(hyphen),_(underscore),(space),.(dot). Hyphen is the Diceware standard.
Password hygiene checklist
- Unique per service: never reuse (credential stuffing).
- Randomly generated: no patterns, dates, names, substitutions (
@→a). - Stored in manager: Bitwarden (open source), 1Password, KeePassXC, Proton Pass, Vaultwarden (self-host).
- 2FA enabled: TOTP (Authy, Aegis, Bitwarden) > SMS > email. Passkeys where available.
- Strong master passphrase: ≥ 80 bits (5 EFF Long words + separator).
- Periodic review: export vault →
haveibeenpwned.com(or manager’s built-in feature).
What NOT to do
| ❌ Bad | ✅ Good |
|---|---|
Summer2024! on 10 sites |
Unique 5-word passphrase for master; random 18+ char passwords for each site (in manager) |
| Store in Excel/Notes/Google Docs | Encrypted password manager (zero-knowledge) |
| Share via WhatsApp/email | Share via vault sharing (Bitwarden Organizations, 1Password Families) |
| Rotate every 90 days (old policy) | Change only if breached (NIST 800-63B). Length + randomness > forced rotation. |
Total privacy: client-side only
- CSPRNG:
crypto.getRandomValues(new Uint32Array(n))— OS entropy (RDRAND, getrandom, /dev/urandom). - Zero network: page is static (Astro), JS runs in your browser. Open tool, disconnect WiFi, keep generating.
- Zero storage: no
localStorage, nosessionStorage, no IndexedDB, no cookies. - Zero analytics: no GA, no Plausible, no Matomo on the tool.
Technical references
- NIST SP 800-63B (Digital Identity Guidelines): length ≥ 8, no composition rules, breach screening, no forced rotation.
- Diceware / EFF wordlists: 7,776 words, 12.9 bits/word.
- BIP-39: 2,048 words, 11 bits/word, built-in checksum.
- zxcvbn (Dropbox): realistic entropy estimator (used internally to show bits).
Need a strong password now? → Open generator and get one in 1 click (client-side, zero logs).