A password drawn character by character from your browser's cryptographic random source. It is made after this page has loaded, in this tab, and it exists nowhere else — not in the page source, not in a log, not on our servers.
Three things about generating a password are easy to get wrong, and most generators get at least one of them wrong. The random source has to be the cryptographic one, not the ordinary one, whose internal state can be recovered from a short run of its own output. The draw has to be unbiased: 256 does not divide by 26, so folding a random byte into the alphabet with a remainder gives a to v ten chances each and w to z only nine — the first twenty-two letters come up 11% more often than the last four. And "at least one of each" has to be enforced by drawing again, not by overwriting the first few characters — that version pins a known kind of character to a known position and throws away the entropy it claims to be adding.
The bits figure below accounts for all of it, which is why it is sometimes slightly lower than the length and alphabet alone would suggest.
No. It is generated by your own browser, after the page has loaded, and no request carrying it is ever made. It is not written to the page source, not logged and not stored. Close the tab and it is gone — so copy it into your password manager before you do.
Your browser's cryptographic random number generator, which draws on entropy the operating system collects from hardware. The ordinary random function most scripts use is a predictable sequence — recover its internal state from a handful of outputs and every past and future value is known. It must never generate a password, and it does not here.
The number of bits of guessing an attacker faces. Each extra bit doubles the work, so the scale climbs fast: at the rate assumed below, 40 bits falls in under a second, 60 bits takes about a week, and 80 bits takes nineteen thousand years. It measures the process that made the password, not the string itself — which is why a password you invented is worth far less than it looks.
Because it rules passwords out. Insisting on at least one digit means every password without a digit is no longer possible, so there are fewer of them to guess. The effect is small — well under a bit at any sensible length — but it is a reduction, not an increase, and this page quotes the honest figure rather than the one the length and alphabet alone would suggest.
In the long run, yes, because length is the one that scales without limit. Doubling the size of the alphabet adds exactly one bit per character, and there are only so many times you can double it; every extra character adds another log2(alphabet) bits, and you never run out of those. The table on this page is the illustration — 12 characters using all four sets is worth 77.5 bits, and 20 plain lower-case letters is worth 94.
A trillion guesses a second — an offline attack, on dedicated hardware, against a password stored with a weak hash. It is a deliberately pessimistic figure. A well-run service that rate-limits attempts is many orders of magnitude slower, but you have no way to know which kind you are dealing with.
Capital i, lower L and one; capital O, lower o and zero. Those six collide in most typefaces, so a password containing them is one you will mistype off a screen or a printout. Removing them shrinks the alphabet and costs a little entropy — worth it if you have to read the password back, not otherwise.
At a trillion guesses a second, on average. Every extra bit doubles the figure, so the twenty bits between 60 and 80 are a factor of a million.
Twelve characters using every class is barely ahead of sixteen plain letters, and well behind twenty. Widening the alphabet buys one bit per character each time you double it, and you run out of characters to add; length keeps paying and does not.
That is the figure when nothing is constrained. Requiring one character from each set removes some of the possible passwords, so the real figure is a little lower — this page works out how much lower and shows that instead.
A password is only as safe as where you keep it. Put this one straight into a password manager — do not email it to yourself, and do not reuse it. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
