Password generator
Strong, random passwords and memorable passphrases, generated on your device. We never see, store or send them.
Attackers guess billions of passwords per second. What stops them is the number of possible combinations, and every extra character multiplies it.
Knowing how passwords are actually broken shows which advice matters. Pick an attack to see how it works and what stops it.
Attackers start with lists of real leaked passwords and dictionary words, plus predictable tweaks: capital first letter, 1 or ! at the end, a → @, o → 0.
Most strength meters count character types: “Summer2026!” has capitals, digits and a symbol, so it looks strong. Crackers don't guess characters, they guess patterns: a common word, then a year, then an exclamation mark. This analysis runs on your device, splits your password into the patterns a cracker would try and estimates the guesses each takes. Nothing is sent unless you press the breach check, and even then only the first 5 characters of a hash leave your device.
The estimator is a simplified version of the approach used by Dropbox's zxcvbn. It knows about 30 of the most common leaked passwords, this page's 100-word list, letter-for-number swaps, keyboard runs, repeats and years. Real cracking dictionaries hold billions of entries, so treat a high score as an upper bound.
Random bytes run from 0 to 255. Picking a character with byte % alphabetSize looks harmless, but unless 256 divides evenly, the first few characters come up more often. Your browser just drew 262,144 real random bytes from crypto.getRandomValues and mapped them both ways. This page uses the second way, rejection sampling: bytes that would cause bias are thrown away and redrawn.
random[i] % 62redraw if random[i] ≥ 248When a site is breached, attackers get password hashes, not passwords. How fast they can test guesses depends entirely on which hash the site chose. Below, your device runs real PBKDF2-SHA256 through Web Crypto to show what a deliberately slow hash costs. It then shows how long the password in the generator at the top would last against each common hash.
All three can be secure. The right one depends on whether you'll ever have to type or remember it.
x9#Lq!2vR@m8Tz$wAmber-Otter-Lotus-Quill42739 204Much familiar password advice, such as forced symbols or changing every 90 days, has been dropped by NIST. These are the current rules for sites, and the settings OWASP recommends for storing passwords.
m=19456 (19 MiB), t=2, p=1Memory-hard, so GPUs and custom chips gain far less. Winner of the 2015 Password Hashing Competition.N=2^17 (128 MiB), r=8, p=1Also memory-hard. Widely available in standard libraries.cost 10 or moreOnly the first 72 bytes of the password count. Pre-hash longer inputs carefully.HMAC-SHA-256, 600,000 iterationsNot memory-hard, so GPUs run it fast. Use it only where compliance requires it.