Password Generator

What makes a password strong

Password strength is counted in bits of entropy, and every extra bit doubles the number of guesses an attacker would need. Current guidance looks like this:

• 40 bits or fewer: weak. Someone with an ordinary GPU setup could crack it within hours.
• 60 bits: fair. It holds up against casual attempts, though not against a nation-state attacker.
• 80 bits: strong. With today's hardware, brute force is not a realistic way to break it.
• 100 bits or more: more than most people need, but right for encryption keys.

Three habits that keep accounts safe

1. Go long. Twenty lowercase letters beat an 8-character password that mixes every character type. Aim for 16 characters or more.
2. Use each password once. A password manager such as Bitwarden, 1Password or KeePassXC can create and remember a different one for every service. If you reuse a password, one breach at the least secure site puts every account at risk.
3. Turn on 2FA wherever it is offered. For important accounts like email, banking and hosting, a password on its own is not enough any more, however strong it is.

Your privacy

Everything happens inside your browser, which draws on the cryptographically secure window.crypto.getRandomValues API. We never receive, log or store the passwords you create. To check, open DevTools, go to the Network tab and generate a few: you will see no requests go out.

Times it is most useful

• Opening a new hosting or DirectAdmin account
• Adding mailboxes on your own domain
• Admin logins for WordPress
• MySQL and other database users
• Webhook secrets and API keys
• Client secrets for M-Pesa APIs and payment gateways