Password Generator

Password Length Guidelines by Context

Security requirements vary significantly depending on the account type and threat model. For a low-risk forum account where compromise has minimal consequences, a 12-character alphanumeric password generated by this tool provides adequate protection. For a primary email account that controls password resets for other services, use at least 16 characters with all character types. For password manager master passwords and encrypted volume passphrases, use the maximum allowed length — often 30 to 64 characters — to maximize protection.

Consider the human factors as well: a password that is too long may discourage its use or lead to users writing it down. Balance security needs with practical usability. A 20-character random password with all character sets enabled offers approximately 131 bits of entropy, placing it in the extreme category of the entropy classification table below.

Password Entropy

The strength of a randomly generated password is measured by its Shannon entropy:

Where: H = entropy in bits, S = size of the character set, L = password length

Character Set Size

S = Su + Sl + Sd + Ss. Typical values: Uppercase = 26, Lowercase = 26, Digits = 10, Symbols = 32

Entropy Classification

Calculating Entropy in Practice

To calculate the total entropy of a password manually, apply the formula H = L × log2(S). First determine the character set size S based on the selected character types. For example, a password using uppercase letters (26), lowercase letters (26), and digits (10) has S = 62. For an 8-character password with this set, H = 8 × log2(62) = 8 × 5.95 = 47.6 bits. For a 16-character password with the same set, H = 16 × 5.95 = 95.2 bits — more than double the entropy with only twice the length.

The relationship between length and entropy is linear because each additional character independently contributes the same amount of entropy. This means that increasing password length is consistently more effective than adding rare character types. Adding symbols to an alphanumeric 62-character set increases S to 94, raising entropy per character from approximately 5.95 to 6.55 bits. However, adding just two more characters of alphanumeric-only content (increasing L from 8 to 10 with S = 62) adds 11.9 bits of entropy, while adding the full symbol set to an 8-character password adds only 4.8 bits. In practice, a 12-character alphanumeric password (71.4 bits) is stronger than an 8-character password with all 94 printable characters (52.4 bits).

Real-world cracking speed depends on both the attacker's hardware and the hashing algorithm used by the target service. A GPU cluster optimized for NTLM hashes can attempt tens of billions of guesses per second, while bcrypt with a high cost factor reduces the same hardware to a few thousand guesses per second. The entropy classification table above assumes a moderate attacker capability of 10^9 guesses per second, but services using modern key-derivation functions like bcrypt, scrypt, or Argon2id dramatically increase the real-world security of any given entropy level.

Passphrase vs Password

For master passwords that need to be memorable, consider generating passphrases — sequences of random common words separated by spaces or hyphens. A four-word passphrase from a dictionary of 7,776 words has approximately 51 bits of entropy (roughly equivalent to a 9-character random password) but is significantly easier to type and remember. Passphrases also score higher on usability metrics because they are less dependent on visual character memory and can be typed quickly even on mobile keyboards.

The security of a passphrase depends entirely on the randomness of word selection, not on the unusualness of the words themselves. A passphrase composed of four common words selected uniformly at random from a 7,776-word list — such as "correct horse battery staple" — is secure because each word independently contributes log2(7776) = 12.9 bits of entropy. In contrast, a hand-crafted phrase using a favorite quote or personal reference provides far less entropy because the words are not randomly chosen and may be guessable from personal information or common cultural references.

For even stronger security, increase the word count. A five-word passphrase provides approximately 64.5 bits of entropy, and a six-word passphrase reaches 77.4 bits. Most password managers support passphrase generation natively, and many services that accept long passwords will accept passphrases without issue. However, be aware that some legacy systems impose maximum length limits that passphrases may exceed.

Multi-Factor Authentication

Multi-factor authentication (MFA) is the single most effective way to secure accounts beyond password strength alone. Enable MFA on every service that supports it. According to Microsoft, MFA blocks over 99.9% of account compromise attacks. Even if an attacker obtains your password through a data breach or phishing attack, MFA requires a second factor — something you have (a phone, hardware token) or something you are (biometric) — to complete authentication.

Three common MFA methods ranked by security: Time-based one-time passwords (TOTP) generated by authenticator apps like Google Authenticator or Authy provide good security and do not rely on cellular networks. Hardware security keys such as FIDO2 or WebAuthn-compliant USB keys offer phishing-resistant authentication and are considered the gold standard. SMS-based verification codes, while better than no MFA, are vulnerable to SIM-swapping attacks and are no longer recommended by NIST as an out-of-band verification method.

The most secure configuration combines a unique, high-entropy password generated by this tool with a hardware security key for accounts that support it, and TOTP as a fallback. This layered approach ensures that compromise of any single factor does not expose the account.

Recommended Password Lengths by Security Level

Brute-Force and Dictionary Attacks

Brute-force attacks systematically enumerate every possible combination of characters within a defined search space. The time required to exhaust the search space depends on the password's entropy and the attacker's computational resources. A GPU-based cracking rig with multiple RTX 4090 cards can attempt approximately 300 billion NTLM password hashes per second, meaning an 8-character alphanumeric password (47.6 bits, 62^8 = 218 trillion combinations) could be fully enumerated in approximately 12 minutes. Adding a single character to reach 9 characters (55.6 bits, 62^9 = 13.5 quadrillion combinations) increases the search time to over 12 hours, and 10 characters (63.7 bits, 62^10 = 839 quadrillion) requires more than a month of continuous cracking.

Dictionary attacks are more efficient than brute force because they exploit human password selection patterns. Attackers compile lists of common passwords, leaked credentials, and word variations — including common substitutions like "p@ssw0rd" — to dramatically reduce the search space. The most common passwords according to annual surveys by NordPass and SplashData continue to include "123456," "password," and "qwerty," all of which will be cracked in under one second regardless of hashing algorithm. A randomly generated password from this tool is immune to dictionary attacks by construction since it contains no dictionary words or human-selected patterns.

Credential Stuffing and Password Reuse

Credential stuffing attacks exploit the widespread practice of password reuse across multiple services. Attackers obtain username and password pairs from a data breach at one service — for example, a 2023 breach exposing 37 million records — and automatically attempt those same credentials at dozens of other popular services. This attack is highly effective because studies consistently show that over 50% of users reuse passwords across multiple accounts. A credential stuffing attack does not require any cryptographic cracking; it simply uses credentials that the user voluntarily provided to another service.

The only complete defense against credential stuffing is to use a unique password for every account. Each password generated by this tool should be used for exactly one service and stored in a password manager. If one service suffers a data breach, only that single account is compromised, and the attacker gains no leverage against other accounts.

Phishing and Social Engineering

Phishing attacks trick users into voluntarily revealing their credentials by impersonating legitimate services through deceptive emails, websites, or messages. Even the strongest randomly generated password provides no protection if the user types it into a fake login page. Modern phishing kits can create convincing replicas of major service login pages, and spear-phishing campaigns target specific individuals with personalized lures crafted from publicly available information.

Defense against phishing requires behavioral safeguards rather than technical password strength. Always verify the URL of any page where you enter credentials, enable MFA as described above, and use a password manager that supports automatic form filling with domain matching — a password manager will refuse to autofill credentials on a lookalike domain, providing an additional layer of phishing protection that a manually typed password lacks.

Understanding Password Strength Limitations

While entropy provides a theoretical measure of password strength against brute-force attacks, real-world security depends on many additional factors. A password with high entropy stored on a compromised device or transmitted over an unsecured network is still vulnerable regardless of its mathematical strength. Password reuse remains one of the most common attack vectors — even a perfectly random password is useless if the service storing it suffers a data breach and stores passwords in plaintext or with weak hashing.

The tool generates passwords based on cryptographic randomness but cannot protect against keyloggers, malware, shoulder surfing, or social engineering. Environmental security — keeping your devices updated, using reputable antivirus software, and maintaining physical security — is equally important as password strength. Additionally, some services impose their own constraints that may limit the effectiveness of generated passwords, such as maximum length limits or restrictions on certain characters.