Secure Password Generator & Strength Checker
Generate strong random passwords, passphrases and PINs in your browser. See the entropy in bits and how long a guessing attack would take. Nothing you generate leaves your device.
Written by Suhaib Hassan. Figures are estimates you can edit. Our methodology.
It draws every character with the browser's cryptographic random generator using rejection sampling, then computes entropy as length times log₂ of the pool size.
Password advice is full of myths. This shows the actual entropy of what you generate, so length and randomness are easy to judge.
—
| Online, rate limited 100 guesses per second | — |
| Offline, fast hash on a GPU rig 100 billion per second | — |
| Offline, large cluster 100 trillion per second | — |
How long a random password lasts
Average time to guess a random password by brute force at 100 billion guesses per second, the speed of a fast offline attack on a weakly hashed password. Well-hashed passwords are far slower to attack.
| Characters used | 8 | 12 | 16 | 20 |
|---|---|---|---|---|
| Lowercase only (26) | 1 seconds | 6 days | 6,909 years | 3.2 × 109 years |
| Letters and digits (62) | 18 minutes | 511 years | 7.6 × 109 years | 1.1 × 1017 years |
| All keyboard characters (95) | 9 hours | 85,615 years | 7.0 × 1012 years | 5.7 × 1020 years |
Formulas
How the numbers are worked out.
Entropy of a random password
Each character is chosen uniformly from N symbols, so the number of possibilities is N raised to the length L.
entropy = L × log₂(N) bitsEntropy of a passphrase
Each word is picked at random from a list of W words.
entropy = words × log₂(W) bits
list here: 776 words, 9.60 bits eachAverage time to guess
An attacker searches half the possibilities on average.
time = 2(entropy − 1) ÷ guesses per secondWorked examples
Illustrative figures, each checked by hand. The first is the default setup.
20 characters, all types
Upper, lower, digits and symbols, 26 symbols (the default is close to this).
entropy = 20 × log₂(88) = 129.2 bits
6-word passphrase
Words picked from the 776-word list.
adding a number adds 3.3 bits
6-digit PIN
Digits only.
only 1,000,000 possibilities, so it needs a lockout
How to create a strong password
- Choose random password, passphrase or PIN.
- Length matters most. Use at least 16 characters, or 7 or more words.
- Copy it straight into a password manager.
- Use a different password for every account.
Use a password manager and turn on two-factor authentication. Time-to-guess figures assume the attacker has the hashed password and a fast hash; a well-designed system slows guessing greatly.
By Suhaib Hassan · Reviewed 29 September 2026 · How CalculatePilot verifies formulas →
Sources
- NIST, SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management.
- Shannon, C.E., A Mathematical Theory of Communication, Bell System Technical Journal, 1948.
- MDN Web Docs, Crypto.getRandomValues().
Frequently asked questions
Is this generator safe to use?
Passwords are created in your browser with the secure random generator. Nothing is sent to a server or stored.
How long should a password be?
At least 16 characters for a random password, and longer for important accounts. NIST guidance stresses length over complexity rules.
What is entropy?
A measure of unpredictability in bits. Each extra bit doubles the number of guesses needed. Above about 80 bits is very hard to brute force.
Are passphrases as good as passwords?
A passphrase of enough random words is strong and easier to remember. Six words from this list is about 58 bits; seven or eight is stronger.
Should I avoid similar-looking characters?
It only matters if you type the password by hand. It slightly reduces the pool, so add a couple of characters to compensate.
Related calculators
More everyday tools.