How it keeps your password safe
- Real randomness: passwords come from your browser's cryptographic random generator (crypto.getRandomValues), not Math.random, which is predictable.
- No bias: each character is picked with rejection sampling, so every character in the set is exactly as likely as any other.
- Every type you choose is included: if you tick symbols, the password always contains at least one.
- Nothing leaves your device: there's no server involved, and nothing is stored or logged.
What makes a password strong
Strength depends on two things: how long the password is and how many different characters it could contain. The meter shows this as bits of entropy. Every extra bit doubles the number of guesses an attacker would need.
Length matters more than complexity. A 16-character password using all four character types has about 103 bits of entropy. Even a computer making a trillion guesses a second wouldn't get through that in the lifetime of the universe. An 8-character one has about 52 bits and can fall in hours.
Good password habits
- One password per account: when one site leaks, reused passwords let attackers into everything else.
- Use a password manager: Bitwarden, 1Password, Apple Passwords or Google Password Manager remember them for you.
- Turn on two-factor authentication: an authenticator app or passkey stops most account takeovers even if a password leaks.
- Don't build passwords from personal details: names, birthdays and phone numbers are the first things attackers try.
How long it takes to crack a password
Assuming an attacker with fast hardware making 100 billion guesses a second against a leaked hash, and a truly random password:
- 8 characters, lowercase only: seconds
- 8 characters, all four types: under a day
- 12 characters, all four types: over 100,000 years
- 16 characters, all four types: far longer than the age of the universe
- Real-world passwords built from words, names and dates fall much faster than these figures, because attackers try those first.
Passphrases vs random passwords
A passphrase of four or five random common words, like 'orbit-candle-humid-ferry', is easier to remember and type than a random string. With words picked at random from a list of 7,776 (the Diceware list), each word adds about 12.9 bits, so five words gives about 65 bits and six about 78.
For anything you store in a password manager, a random 16 to 20 character password is stronger and you never have to type it. Save passphrases for the few you must remember, like the manager's master password.