Password strength comes from two things: length and the size of the alphabet the password is drawn from. A 16-character password drawn from 90 possible characters has entropy of 16 × log2(90) ≈ 104 bits, which is enough to resist brute-force attacks from any realistic adversary. A 6-character password drawn from just lowercase letters has 6 × log2(26) ≈ 28 bits, which a modern GPU cracks in seconds.
This tool lets you pick the length and which character sets to include, then shows the entropy in bits for the generated password so you can see how strong it actually is. The password itself is generated by the browser’s built-in cryptographic random number generator (Web Crypto’s crypto.getRandomValues), not Math.random.
How entropy is calculated
The alphabet size depends on which character sets you select:
| Character set | Size (default) | Size (ambiguous excluded) |
|---|---|---|
| Lowercase a-z | 26 | 23 (excludes o, l) |
| Uppercase A-Z | 26 | 24 (excludes O, I) |
| Numbers 0-9 | 10 | 8 (excludes 0, 1) |
Symbols !@#$%^&*()_-+=[]{}<>?/,.:; | 25 | 22 (excludes `, ', ") |
Strength thresholds
The strength label reflects entropy in bits against a practical attacker:
- Under 28 bits → very weak (seconds to crack offline)
- 28 to 36 bits → weak (hours)
- 36 to 60 bits → fair (days to months)
- 60 to 128 bits → strong (years to centuries with current hardware)
- 128 bits and up → very strong (computationally infeasible)
For comparison, a standard AES-128 key has exactly 128 bits of entropy. 60 bits is the practical minimum for any password that protects real value.
Example: 16-character password with all character sets
With lowercase + uppercase + numbers + symbols, the alphabet has 87 characters (26 + 26 + 10 + 25). A 16-character password from this alphabet has:
That’s strong enough to resist any realistic brute-force attack — an attacker trying a billion passwords per second would need longer than the age of the universe to exhaust the space.
When to use which options
- Shared or dictated passwords (you have to read it to someone or write it down): turn on “Exclude ambiguous” so the reader doesn’t confuse
0andO,1andl. - Systems that reject symbols: turn off symbols and compensate by increasing length — a 20-character alphanumeric password has
20 × log2(62) ≈ 119 bits, still very strong. - Systems that require all character classes: turn on “Require one from each set” to guarantee the password passes validation on the first try.
- Encryption keys or high-value accounts: bump the length to 24 or 32 to get 140+ bits of entropy.
What this tool does not do
It does not store passwords, suggest passwords you already use, or check whether a password has appeared in a breach. For those, use a dedicated password manager. This tool is for the moment you need a fresh, strong password right now and want to see the math behind its strength. For a memorable word-based alternative (XKCD-style “correct horse battery staple”), the passphrase generator uses Diceware wordlists instead of character classes.