ToolzPassword Generator
Build strong random passwords with the rules you choose.
—
~129 bits of entropy — Very strong
Nothing here is transmitted
The password is assembled in your browser from crypto.getRandomValues(), the same cryptographically secure source used to generate encryption keys — not Math.random(), whose output is predictable to anyone who has seen enough of it. No password is ever sent over the network, and closing the tab is enough to be rid of it.
Length beats complexity
Entropy is the number of bits an attacker would have to guess through, and it grows linearly with length but only logarithmically with alphabet size. Adding one character to a lowercase-plus-digits password buys about five bits; adding the full symbol set to a short one buys less. This is why a 20-character password drawn from two character sets is far harder to crack than an 8-character password using all four — and much easier to type on a phone.
Reading the strength figure
Below about 50 bits, an attacker with commodity GPUs and a leaked password hash is within reach. Around 75 bits is comfortable for an ordinary account, and past 100 bits brute force stops being the weak link — phishing, reused passwords and password reset flows are. The number assumes the attacker knows exactly which character sets you used, which is the honest assumption to make.
Where these passwords should live
A random 20-character string is not memorable, and it should not have to be: generate one per account and keep them in a password manager. The passwords you do need to remember — the manager’s own master password, your device login — are better built as a long passphrase of several unrelated words, which reaches similar entropy while staying typeable. And whatever the password’s strength, turn on two-factor authentication where it is offered.