Why Password Strength Matters
Every year, billions of credentials leak in data breaches. Attackers use these leaks to try the same passwords on other sites — a technique called credential stuffing. If you reuse even one password, a breach on one site can compromise all your accounts. Strong, unique passwords are the single most important defense against this.
Password strength is measured in entropy — the number of bits of randomness. An 8-character password with lowercase letters has ~37 bits of entropy. A 20-character password with mixed characters has ~130 bits. Every additional bit doubles the search space an attacker must cover, so length matters more than complexity.
Entropy and Crack Time
| Password Type | Entropy | Crack Time (offline) |
|---|---|---|
| 8 lowercase letters | ~37 bits | Seconds |
| 12 mixed chars | ~78 bits | Years |
| 16 mixed chars | ~104 bits | Millions of years |
| 20 mixed chars | ~130 bits | Billions of years |
| 6-word passphrase | ~77 bits | Years |
The 8 Generation Modes
1. Random
Standard password generation from selected character sets. Customize length, exclude ambiguous characters, and start with a letter. The default choice for most accounts.
2. Passphrase
Generate Diceware-style passphrases from a built-in wordlist. Six random words produce ~77 bits of entropy, far easier to remember than random strings. Example: correct-horse-battery-staple.
3. Pronounceable
Generate passwords that follow consonant-vowel patterns, making them easier to speak and remember. Example: kabadoru. Slightly less entropy per character than random, but far more memorable.
4. PIN
Numeric-only PIN codes for banking apps, SIM cards, and device locks. Length is typically 4-8 digits.
5. Memorable
Combines a word, a number, and a symbol into a memorable pattern. Example: Sunset-2024-Tiger!. Good middle ground between random and passphrase.
6. Template
Use a pattern like ?u?l?l?l?d?d?s to control exact structure. ?l = lowercase, ?u = uppercase, ?d = digit, ?s = symbol, ?a = any.
Understanding zxcvbn
zxcvbn is a password strength estimator developed by Dropbox. Unlike simple entropy calculators, zxcvbn recognizes common patterns — dictionary words, keyboard walks, dates, repeated characters, l33t-speak substitutions — and estimates how long an attacker with knowledge of these patterns would take to crack the password. This makes it far more accurate than raw entropy.
This tool uses zxcvbn to display a strength score (0-4) and a crack-time estimate for each generated password. If a password scores below 3, it may not be strong enough for critical accounts.
What Makes This Tool Different
- Real CSPRNG. Uses
crypto.getRandomValues(), notMath.random(). The latter is not cryptographically secure. - zxcvbn-powered analysis. Shows real strength, not just entropy.
- 8 modes in one tool. Random, passphrase, pronounceable, PIN, memorable, template — no other free tool offers all in one place.
- Bulk generation. Generate up to 100 passwords at once for team deployments.
- Safe defaults. Excludes ambiguous characters by default (0/O, l/1/I), which cause login failures.
- No data collection. Nothing is logged, stored, or transmitted.
Best Practices
- Use a password manager. It removes the burden of remembering 100 passwords. Bitwarden, 1Password, KeePass, and Proton Pass are excellent.
- One password per account. Never reuse. The whole point is that a breach on one site does not affect others.
- Enable 2FA. A strong password plus TOTP or a hardware key is far stronger than either alone.
- Check pwnedpasswords.com. This free service tells you if a password has appeared in a known breach.
- Length beats complexity. A 20-character lowercase password is stronger than an 8-character mixed one.
Frequently Asked Questions
Related Tools
External Resources
- EFF Diceware — the wordlist used for passphrases
- zxcvbn on GitHub — Dropbox password strength estimator
- Have I Been Pwned — check if a password has leaked
- MDN: crypto.getRandomValues — CSPRNG reference