ReckonBoxA strong password, made in your browser
A password generator builds a random string from character sets you choose, so the result is far harder to guess than anything a person would invent. This one runs entirely in your browser using cryptographic randomness, so the password never leaves your device.
Most generators stop there and slap a colored bar or the word "Strong" on the output. That tells you almost nothing. This tool shows the actual entropy in bits, the honest measure of how many guesses an attacker would face, and it uses that number to make a point the polished tools skip: length matters more than a clever mix of symbols.
Entropy is the number that matters
Password entropy is how unpredictable a password is, measured in bits, and it equals the length times the base-2 logarithm of the pool of possible characters. A 16-character password drawn from a pool of 85 characters carries about 103 bits.
Each bit doubles the work an attacker faces, so 103 bits means roughly 2 to the 103 possible passwords to sift through. That is why a bit count beats a colored bar: 40 bits and 90 bits might both light up green on a lazy strength meter, yet one falls in seconds and the other outlives the sun. The pool grows as you enable more character types, from 26 for lowercase alone up to 85 with upper, lower, numbers, and this tool's symbol set.
Length beats complexity, and NIST agrees
The instinct to cram in symbols is mostly wasted effort. Because entropy multiplies by length but only adds a little when the pool widens, stretching a password does far more than decorating it.
| Password style | Length | Pool | Entropy |
|---|---|---|---|
| Lowercase only | 16 | 26 | about 75 bits |
| Upper, lower, numbers, symbols | 8 | 94 | about 52 bits |
| Upper, lower, numbers, symbols | 16 | 85 | about 103 bits |
The 16-character all-lowercase password beats the 8-character everything-goes password by more than 20 bits, which is over a million times more guesses. The US National Institute of Standards and Technology built this into SP 800-63B, which tells systems to allow long passwords, accept every printable character, and stop forcing a mix of character types. The old "must contain an uppercase, a number, and a symbol" rule is gone from the guidance.
How long to crack, told honestly
A crack-time estimate is only as good as its assumption about how the site stored your password. Using the Hive Systems 2026 benchmark, an attacker cracking bcrypt hashes on a rented GPU fleet manages about 138,675 guesses per second, and at that pace anything above roughly 70 bits is effectively forever. Against a site that uses a fast or unsalted hash, the same attacker runs billions of guesses per second and the picture tightens. This tool reports the bcrypt figure and says so, because a number without its assumption is a guess dressed up as a fact.
What this tool is and is not
This generates strong random strings and measures them. It is not a password manager, so it will not store the result, sync it, or fill it in for you. Copy the password somewhere safe, ideally a real password manager, and use a different one for every account, since the whole point of a unique password is that one breached site cannot unlock the others. The generation is local and nothing is transmitted, so you can even take the page offline and it still works.
A 20-character password from four character sets clears 128 bits, the point past which brute force stops being a threat and the only realistic attacks are phishing and reuse.
Frequently asked questions
How does this password generator work? It builds a password by drawing characters at random from the sets you enable, using your browser cryptographic randomness (the Web Crypto API). Everything happens on your device, so the password never travels to a server or gets logged. Turn character types on or off, set the length, and press generate for a fresh one. This is a generator, not a password manager, so save the result somewhere safe.
What is password entropy? Password entropy is a measure of how unpredictable a password is, in bits, and it equals the length times the base-2 logarithm of the pool of possible characters. A 16-character password drawn from 85 possible characters carries about 103 bits. Each extra bit doubles the number of guesses an attacker needs, so entropy is a far more honest strength signal than a colored bar, which is why this tool shows the number.
Is a longer password or a more complex one stronger? Length wins, and it is not close. Because entropy is length times the log of the character pool, adding characters multiplies the strength while adding symbol types only nudges the pool. A 16-character all-lowercase password holds about 75 bits, while an 8-character password using upper, lower, numbers, and symbols holds only about 52 bits. The US National Institute of Standards and Technology reflects this in SP 800-63B, which dropped the old rules forcing a mix of character types.
How long would it take to crack a password from here? It depends entirely on how the site stores it. Using the Hive Systems 2026 benchmark, an attacker cracking bcrypt hashes on a rented GPU fleet manages about 138,675 guesses per second, and at that rate a high-entropy password is effectively uncrackable. Against a site that uses a fast or unsalted hash, the same attacker runs billions of guesses per second, so the margin shrinks. High entropy is your protection either way.
What does the NIST guidance actually recommend? NIST SP 800-63B says passwords should be at least 8 characters and that systems should allow at least 64, accept all printable characters including spaces, and stop forcing composition rules like a required mix of character types. It also says new passwords should be checked against lists of breached passwords. The throughline is that length and uniqueness matter, and arbitrary complexity rules mostly just make passwords harder to remember without making them meaningfully stronger.