A good password is random and long. People are bad at random, which is why "P@ssw0rd2024!" is in every cracking dictionary. This generator draws characters from your browser’s cryptographic random number generator, shows how much randomness (entropy) the result contains, and translates that into how long a brute-force attack would take. The password is created on your device and never sent to any server.
How it works
- Characters are picked uniformly from the pool you enable, using the Web Crypto API (crypto.getRandomValues), the same source password managers use. At least one character from each enabled type is included, then the order is shuffled.
- Entropy = length × log₂(pool size). Sixteen characters from an 89-character pool give 16 × 6.48 = 104 bits.
- Crack time = 2entropy ÷ 2 ÷ guesses per second. Ten billion guesses a second is a realistic rate for a GPU rig against a weak hash like MD5 or NTLM; against bcrypt or Argon2 it is closer to 100,000 a second, so the times shown are conservative.
What the numbers mean
Under 40 bits is cracked in seconds offline. 60 bits holds for days against a serious attacker. 80 bits is years, and 100+ bits is effectively uncrackable by brute force with foreseeable hardware. A 12-character password with all four types is about 79 bits; 16 characters is 105 bits. Length beats complexity: adding four characters adds more entropy than adding symbols.
Use a password manager
Random passwords are impossible to remember, which is the point: use a password manager to store them and generate a unique one for every site. The one password you do memorize, for the manager itself, should be a long passphrase of five or six random words, which gives 60–75 bits and is far easier to type than symbols. Turn on two-factor authentication wherever it is offered; it protects you even if a password leaks.
Frequently asked questions
How long should a password be?
At least 12 characters with mixed types for ordinary accounts, 16 or more for email, banking and your password manager. Length adds more strength than symbols do.
Is this generator safe to use?
The password is generated in your browser with the operating system’s cryptographic random source and is never transmitted. You can turn off your internet connection and it still works. Even so, for sensitive accounts a password manager’s built-in generator is the standard tool.
What is entropy?
A measure of how many guesses an attacker would need: each bit doubles the number. A 40-bit password has about a trillion possibilities; 80 bits, a trillion trillion.
Should I avoid look-alike characters?
Only if you will ever type the password by hand or read it off paper. If a password manager fills it in, ambiguity does not matter and leaving them in adds a little entropy.
Is a passphrase better than a random password?
For anything you must memorize, yes: five random dictionary words give about 64 bits and are easy to remember. For everything stored in a manager, random characters give more entropy per character.
Sources
- NIST SP 800-63B: Digital Identity Guidelines — Authentication (password recommendations)
- MDN: Crypto.getRandomValues()
- Hive Systems: Password table (crack times by length)
By Calcelate Team. Formula from the sources above.
- 2026-09-14 · Formula and texts checked