Strength Visualiser
—
—
Entropy (bits)
—
Crack Time
—
Length
16
We use essential cookies to make our site work. Optional analytics cookies help us understand how you use it. See our Cookie Policy and Privacy Policy.
Create strong, random passwords instantly. Everything runs in your browser, your passwords never touch our servers.
A short password falls instantly, however random it looks. The table and chart below model an offline attack at 10,000,000,000 guesses per second against a fast hash — the same maths a cracking rig actually runs.
| Password pattern | Time to crack | Entropy (bits) | Verdict |
|---|---|---|---|
| 6 lowercase letters | instantly | 28.2 | Weak |
| 8 lowercase letters | 21 seconds | 37.6 | Weak |
| 8 letters + numbers | 6 hours | 47.6 | Moderate |
| 10 mixed characters | 190 years | 65.7 | Moderate |
| 12 mixed characters | 2 million years | 78.8 | Strong |
| 6-word passphrase | 701 thousand years | 77.5 | Strong |
Assumes uniform random characters and no rate limiting. Password reuse or a breach database shortcut all of the above, which is why a unique password per account matters more than length alone.
Our generator uses your browser's built-in cryptographic API, the same technology used by online banking and government systems.
Select length (8–64 characters) and which character types to include. Combining all four types maximises your password's entropy and resistance to brute-force attacks.
Click generate. We use crypto.getRandomValues(), a cryptographically secure pseudo-random number generator (CSPRNG) standardised by NIST. No patterns, no shortcuts.
Our Strength Visualiser shows entropy in bits and estimates crack time against a trillion-guesses-per-second brute-force attack, the standard security benchmark.
Copy your password and store it in a reputable password manager. Never reuse passwords, each account needs its own unique credential. See our recomended tools.
Everything you need to understand and create strong passwords, free, no registration, no tracking.
The Web Crypto API (crypto.getRandomValues()) provides cryptographically secure randomness, the same standard recommended by NIST SP 800-90A for security-critical applications worldwide.
Our unique Password Strength Visualiser calculates entropy in bits, estimates crack time, and shows your password's pool size, instantly updated as you change settings. No other free tool provides this level of analysis.
Every calculation runs in your browser. No passwords are ever transmitted to our servers. No analytics tracking individual keystrokes. Disconnect from the internet and use it, it works completely offline.
Fully responsive across desktop, tablet, and mobile. No app download, no Flash, no plugins required. Open, generate, copy, it's that straightforward.
Control length from 8 to 64 characters, toggle individual character types, and see your changes reflected in real time. Compatible with virtually any platform's password policy.
Our security recommendations follow NIST SP 800-63B and NCSC guidance, the gold standard used by US government agencies, UK public sector organisations, and security professionals globally.
A strong password is only as safe as where it's stored. We recommend these independently reviewed password managers and security tools.
Store all your generated passwords with end-to-end encryption. Access from any device, auto-fill logins, and breach alerts included.
Try Free for 30 Days →Encrypt your connection on public Wi-Fi. Prevent credential interception and browse anonymously, especially important when logging in from unfamiliar networks.
Get Protected →Dark web monitoring for your email and passwords. Instant breach alerts and expert-led recovery support if your credentials are compromised.
Monitor Your Identity →Data from Verizon DBIR, IBM, NCSC, and NordPass confirms that weak or reused passwords remain the primary cause of account breaches worldwide.
For more data, read our Password Security Statistics 2026 guide →
Everything you need to know about password security and how our generator works.
crypto.getRandomValues()) built directly into your browser. This is a cryptographically secure pseudo-random number generator (CSPRNG) standardised by NIST SP 800-90A, the same technology used by financial institutions and government systems. Your password is generated entirely on your device and is never transmitted anywhere.We're a team of cybersecurity professionals who got tired of seeing the same pattern: intelligent, security-conscious people using passwords like "Summer2024!", not from carelessness, but because creating and remembering truly random passwords is genuinely difficult.
Our tool exists to close that gap. We wanted to give everyone, from IT professionals to first-time internet users, access to the same cryptographic-quality password generation used by security experts, with no cost, no data collection, and no complexity.
All our content and recommendations follow guidance from NIST, NCSC, CISA, and the OWASP Foundation. We cite sources for every statistic we publish. We update our guidance when standards change. We never recommend products we haven't independently assessed.
Last reviewed: May 2026 · Visit our blog for the latest security guidance.
Texting or emailing a password leaves it in plain text on servers, chat logs and backups forever. Here is how to share one safely.
Microsoft blocks 7,000+ password attacks every second, stolen credentials start 22% of breaches. Here are 50 data-backed facts.
An 8-character password can fall in seconds, while a 16-character random one survives for trillions of years. Full brute-force time table inside.
Hand-picked security tools, updated weekly.
Budget-friendly 2FA key, USB-A & NFC, FIDO2 certified.
Check price →
Antivirus, VPN & identity protection, 5 devices, 1 year.
Check price →
USB-C 2FA security key with NFC for modern laptops & phones.
Check price →As an Amazon Associate we earn from qualifying purchases.
Hand-picked security tools, updated weekly.
Budget-friendly 2FA key, USB-A & NFC, FIDO2 certified.
Check price →
Antivirus, VPN & identity protection, 5 devices, 1 year.
Check price →
USB-C 2FA security key with NFC for modern laptops & phones.
Check price →As an Amazon Associate we earn from qualifying purchases.