Password Generator

Password strength is determined by two factors: length and entropy (randomness). Entropy is measured in bits -- each bit doubles the number of possible combinations. A 12-character password using uppercase, lowercase, numbers, and symbols has about 78 bits of entropy, which translates to roughly 10^23 possible combinations. Modern GPUs can test billions of passwords per second, so a 78-bit password would take thousands of years to crack. However, many websites enforce complexity rules (requiring special characters) without requiring sufficient length, leading users to create short but complex passwords that are actually weaker than long, simple ones.

The formula for entropy is: bits = log2(charset_size) * length. For example, a 16-character password using all 94 printable ASCII characters has log2(94) * 16 鈮?105 bits of entropy. This is considered uncrackable by any current or foreseeable technology. Our generator uses the Web Crypto API's crypto.getRandomValues() function, which draws entropy from your operating system's secure random source -- the same source used for TLS key generation and disk encryption. This is fundamentally different from Math.random(), which uses a pseudo-random number generator (PRNG) that can be predicted if the seed is known.

Length matters far more than complexity. Adding one character to a password adds more entropy than replacing a letter with a symbol. A 20-character password using only lowercase letters (log2(26) * 20 鈮?94 bits) is stronger than a 12-character password using all character types (log2(94) * 12 鈮?79 bits). This is why NIST guidelines (SP 800-63B) now recommend longer passwords over complex ones, and many services have dropped complexity requirements in favor of length minimums.

Use a unique password for every account. Password reuse is the single biggest security risk -- if one service is breached, attackers will try the same password on other services (credential stuffing). A password manager (Bitwarden, 1Password, KeePass) makes this practical by storing all your passwords in an encrypted vault. You only need to remember one strong master password. Most password managers have built-in generators that can create passwords of any length and complexity.

For your password manager's master password, consider using a passphrase -- a sequence of random words like 'correct-horse-battery-staple'. A 4-word passphrase from a 2000-word list has about 44 bits of entropy, which is sufficient for a master password, and it's much easier to remember and type than a random string. For all other accounts, use the longest random password the service allows, and let your password manager remember it.

Enable two-factor authentication (2FA) wherever possible. Even the strongest password can be compromised by phishing, keyloggers, or data breaches. 2FA adds a second layer of defense -- typically a code from an authenticator app (Google Authenticator, Authy) or a hardware key (YubiKey). SMS-based 2FA is better than nothing but is vulnerable to SIM-swapping attacks. Prefer TOTP (time-based one-time passwords) or hardware keys for maximum security.