Password security,
answered

Password security depends mainly on length, randomness, and character variety. You can test yours instantly and privately with our Strength Checker — it runs entirely in your browser, so your password is never sent anywhere.

Use a tool that relies on k-anonymity SHA-1 hash lookups against the Have I Been Pwned database. Only the first 5 characters of your password's hash are sent to the server, so the full password (or hash) never leaves your device. Our Strength Checker and generator both include this as an optional check.

It depends heavily on how the target system stores it. Against a fast, unsalted hash and modern GPU hardware, an 8-character password using only numbers or lowercase letters can fall in minutes to hours; against a properly salted, slow hash (like bcrypt), it can take dramatically longer. Either way, 8 characters with a small character set is considered weak by current standards — length matters more than any single "time to crack" number.

A strong password is long (current guidance recommends 15+ characters where the system allows it), drawn from a large character pool, and either fully random or built from unrelated words rather than anything tied to your personal details.

Yes, provided the checker runs purely client-side in JavaScript and never makes a network request containing your plain-text password. You can verify this yourself with your browser's developer tools — our own checker makes zero network calls unless you explicitly opt into the breach check.

Entropy measures how unpredictable a password is, expressed in bits. Each additional bit doubles the number of guesses an attacker would need to try, so higher entropy means exponentially greater resistance to brute-force attacks.

It varies by hashing method, but a fully randomized 12-character password mixing uppercase, lowercase, digits, and symbols is generally estimated to take anywhere from centuries to hundreds of thousands of years to brute-force offline — dramatically stronger than an 8-character password, since each added character multiplies the total number of possible combinations rather than just adding to it.

A dictionary attack tries a large precompiled list of common words, names, and known passwords — along with predictable variations like swapping "a" for "@" — to guess a password much faster than trying every possible combination.

A brute-force attack systematically tries every possible character combination, in order, until it finds the correct password. It's slow against long, random passwords but effective against short or predictable ones.

Yes. Cracking tools are specifically tuned for common human patterns — appending a birth year, a "!", or digits like "123" to a base word — so these variations are among the very first things tried.

Generally, yes. Four or five random, unrelated words combined into a passphrase produce more total entropy than a short complex password, while also being far easier for a person to remember and type.

Names, birthdates, pet names, and street addresses are often public or easily found on social media, making them one of the first things attackers try in a targeted guessing or social-engineering attack.

Adding special characters expands the pool of possible characters at each position in the password, which increases the total number of combinations an attacker must try — though length still contributes more to overall strength than character variety alone.

Use a tool built on a cryptographically secure random number generator (CSPRNG) — such as the browser's built-in crypto.getRandomValues() — to create a password of at least 15–16 characters drawn from a mix of letters, numbers, and symbols. Our Password Generator does exactly this, entirely on your device.

They are, as long as the generator runs locally using a browser-native crypto API and never transmits, logs, or stores the result on a server. Check that a site's generator works with no internet connection — if it still works, it's generating locally.

The best generators run entirely offline in your browser, let you adjust length and character-set options, and offer both a fully random mode and a memorable passphrase mode — so you can pick the right trade-off between strength and usability for each account.

Build a passphrase from 4–5 completely unrelated random words, separated by spaces or hyphens — for example, "correct-horse-battery-staple." This is easier to recall than a short jumble of symbols while typically offering more total entropy.

A pronounceable generator strings together consonant-vowel patterns to create a password that's easier to say and type than a fully random string, while still aiming to preserve reasonable entropy — though a true random string or Diceware passphrase is generally stronger for the same length.

Built-in browser generators (like Chrome's or Safari's) are cryptographically sound and convenient. Just make sure the passwords they create are backed up somewhere durable — ideally a dedicated, encrypted password manager — in case you switch browsers or devices.

Visually ambiguous characters like 1, l, I, 0, and O are often excluded so a password is easier to read and retype correctly from a printed card or screen. Our generator includes an "Avoid Ambiguous" toggle for exactly this case.

Current guidance (NIST SP 800-63B-4) recommends a minimum of 15 characters where the system supports it, up from the older 8–12 character recommendations. Longer is always stronger, all else being equal.

Yes — generate a high-entropy password with any trustworthy generator and copy it into iCloud Keychain, or any other password manager, manually or via copy-paste.

A CSPRNG draws from hardware-level entropy sources (like electrical noise or timing jitter) to produce output that's statistically unpredictable, unlike a standard pseudo-random function, which can sometimes be predicted if its internal state is known.

People naturally gravitate toward memorable patterns — keyboard walks, dates, common substitutions — that make manually chosen passwords far more predictable to an attacker than a properly randomized one, even when they feel "random" to the person choosing them.

Diceware maps physical dice rolls to positions in a standardized word list (the EFF Large Wordlist, for example, has 7,776 words) to select truly random words for a passphrase. Our generator's Passphrase mode uses this same wordlist and discloses the exact bits of entropy per word.

Current NIST guidance advises against forced periodic password changes — rotate a password only when there's specific evidence that it (or the account) may have been compromised, since routine forced changes tend to push people toward weaker, more predictable variations.

A bulk password audit tool evaluates a whole list of credentials at once against weak patterns, duplicates, and (optionally) known breach data. Our Bulk Password Audit tool does this entirely client-side, so nothing you paste in is uploaded.

Credential stuffing is an automated attack where bots take username/password pairs stolen from one breach and try them against many other, unrelated websites — exploiting people who reuse the same password across accounts.

IT teams typically run automated audits — comparing user password hashes (e.g. from Active Directory) against breach-hash repositories, or using dedicated breach-monitoring services — to flag accounts using compromised or weak credentials.

If just one lower-security site you use gets breached, attackers immediately have a working credential to try against every other account — banking, email, work systems — where you reused that same password.

Keep the export on an encrypted drive, restrict who can access it, complete your audit as quickly as possible, and securely delete (not just move to trash) the CSV file the moment you're done with it.

A dark web scan checks known data-breach dumps and marketplaces for your email address or credential hashes, alerting you if your information turns up in a leaked dataset.

k-anonymity is a privacy technique where only a short prefix of a password's hash (the first 5 hex characters, in the Have I Been Pwned model) is sent to a server. The server returns all breach matches for that prefix, and the actual comparison happens locally — so your full password or hash is never transmitted.

Run a bulk audit of exported credentials (or, better, hashes) during regular policy reviews to flag anything short, common, reused, or matching a known breach — ideally as an automated, recurring process rather than a one-off check.

Change the password on the breached account immediately, change it on any other account where you reused that same password, and turn on two-factor authentication wherever it's offered.

Active Directory environments typically use Fine-Grained Password Policies plus third-party or Microsoft-native tools (like Azure AD Password Protection) to block banned words and known breached passwords at the point of creation.

Password spraying tries a small number of very common passwords (like "Summer2026!") against a large number of different accounts, rather than many guesses against one account — this helps attackers stay under typical account-lockout thresholds.

They can, if the tool sends your data to a remote server. Always confirm — by checking network activity, if you're able to — that a bulk auditing tool processes everything locally in your browser before pasting in real credentials.

Based on the widely cited 2012 analysis of leaked 4-digit PIN datasets (Nick Berry / DataGenetics), 1234 is by far the most common, accounting for roughly one in ten PINs, followed by others like 1111, 0000, 1212, and 7777.

Avoid birth years, repeated digits, simple sequences (like 1234 or 4321), and shapes that trace a straight or symmetric line on the keypad. A PIN that looks "random" to you is usually still on an attacker's shortlist — check it with our PIN Strength Checker.

Yes — mathematically, a 6-digit PIN has 1,000,000 possible combinations versus just 10,000 for a 4-digit PIN, making pure brute-force guessing 100 times harder (assuming both are chosen with equal randomness).

Avoid years (like 1998), calendar dates (like 0412), simple sequences (1234, 4321), and repeated pairs (1212, 6969) — these make up a disproportionate share of real-world PIN choices and are tried first by attackers.

Many banks lock or retain the card after 3 consecutive incorrect PIN entries, though the exact limit varies by bank, card network, and country — check with your specific bank for its policy.

Yes — visible wear, smudges, or (in research settings) thermal imaging on a physical keypad can reveal which keys are pressed most often, narrowing down the possible digits in your PIN even without seeing you type it.

No — 2580 is a weak, well-known choice because it traces the straight middle vertical line down a standard phone or ATM numeric keypad, making it an easy first guess for anyone testing keypad-shape PINs.

Short numeric PINs balance ease of memorization against brute-force risk — combined with strict attempt limits and lockouts, a 4–6 digit PIN provides reasonable security for physical-access scenarios like ATMs without being impractical to recall.

It's difficult on modern smartphones, which impose escalating delays after each failed attempt and can wipe data entirely after a set number of incorrect tries — a meaningfully different threat model than an offline password-hash attack.

Not necessarily — most people choose predictable pattern shapes (like an "L" or "Z"), and the pattern often leaves a visible smudge trail on the screen that can reveal the shape to an observer, sometimes making patterns easier to guess than a random PIN.

A PIN analyzer checks a numeric code against known-common PIN frequency data, calendar-date patterns, repeated or sequential digits, and keypad-shape patterns (like straight lines or corners) — all things real attackers try before anything else.

Yes — birth years are among the very first guesses attackers try, especially in targeted scenarios (like a lost wallet or phone) where personal details may already be known or easy to find.

Use a generator built on a cryptographically secure random number source — like the browser's crypto.getRandomValues() — that also actively rejects common PINs, keypad shapes, dates, and repeating patterns rather than just outputting raw random digits. Our PIN Generator does exactly this.

It is, as long as the randomness comes from a proper cryptographic source and the result is checked against known weak patterns before it's shown to you. Raw randomness alone isn't enough — about 5–7% of the 4-digit keyspace is made up of PINs like 1234, 0000, and keypad lines that a plain random-number call can still produce by chance.

People are measurably bad sources of randomness — asked to "pick something random," most of us gravitate toward birthdays, repeated digits, or keypad shapes without realizing it. That's exactly why leaked PIN datasets show such a lopsided distribution: a huge share of real-world PINs cluster around a small set of predictable choices.

A good generator checks each freshly generated candidate against the same detectors a PIN strength checker uses — an exact match against known common PINs, sequential and descending runs, repeating pairs, palindromes, keypad-line shapes, and date/year patterns — and simply re-rolls until it produces one that passes every check.

Use the longest length your device or system accepts. A 4-digit PIN has only 10,000 possible combinations; a 6-digit PIN has 1,000,000; an 8-digit PIN has 100,000,000. If you have the choice, 6 digits or longer is meaningfully harder to brute-force than the 4-digit default.

Not reliably — that's the fundamental trade-off. A PIN that's truly unpredictable to an attacker will also be unpredictable to you. If you need to remember it, store it in a password manager rather than choosing a "memorable" PIN that's really just a disguised weak pattern.

Yes, provided it runs entirely client-side and never transmits the generated PIN anywhere. You can verify this yourself by disconnecting from the internet after the page loads — a properly built generator, including ours, keeps working with no connection at all.

It shouldn't. JavaScript's Math.random() is not cryptographically secure and can, in principle, be predicted by an attacker who observes enough output. A proper PIN generator uses crypto.getRandomValues(), the browser's cryptographically secure random number source — the same API used for password generation.

No — a repeating pair like 1212 is one of the specific patterns a proper PIN generator checks for and rejects before showing you a result, along with palindromes (1221), sequential runs (1234, 4321), and keypad-line shapes (2580).

If you can't reliably recall it, yes — but treat the note the way you'd treat a password: store it in a password manager or a physically secured location, not in an unlocked phone notes app or on a sticky note near the device the PIN protects.

A PIN strength checker analyzes a PIN you already have and tells you whether it's weak; a PIN generator creates a brand-new one for you that's already guaranteed to pass that same analysis. Use the checker if you're evaluating an existing PIN, and the generator if you want a fresh one.

Aim for at least 16 characters mixing upper- and lowercase letters, numbers, and symbols — WPA2/WPA3-Personal supports passphrases up to 63 characters, so there's no reason not to use the full range. Our WiFi Password Generator is pre-tuned for this.

Format your network name and password into the standard WIFI:T:WPA;S:SSID;P:PASSWORD;; string (type first, then network name, then password) and encode it as a QR code — this is exactly what our WiFi Password Generator does automatically, and most phone cameras can scan it directly.

WPA3 is the most secure option available today. If some of your devices don't support it, WPA2-Personal (AES) is the next-best, widely compatible choice — avoid WEP and WPA/TKIP entirely, as both are considered broken.

Many factory-default passwords are generated from a predictable, vendor-specific algorithm tied to the router's MAC address or serial number — meaning they can sometimes be computed or looked up rather than truly guessed.

Yes. A weak WiFi password lets an attacker within range capture the network handshake and brute-force it offline, then intercept unencrypted traffic or attack other devices connected to your network.

WPA3-Personal accepts a pre-shared key from 8 to 63 ASCII characters and uses SAE (Simultaneous Authentication of Equals) instead of the older 4-way handshake, which specifically protects against offline dictionary attacks even if the password isn't especially strong.

Log into your router's admin page — typically at an address like 192.168.1.1 or 192.168.0.1 — with the admin credentials (not your WiFi password), then look for the Wireless or Wireless Security section to update it.

It's fine and adds strength, but stick to widely supported symbols and avoid spaces or unusual characters if you have older IoT devices — some smart plugs, printers, and similar gadgets fail to parse them correctly.

Enable the Guest Network feature in your router's settings and assign it a separate, strong password — this keeps guest devices isolated from your primary network and the devices connected to it.

WPS (WiFi Protected Setup) authenticates using an 8-digit PIN that, due to a known design flaw, can often be brute-forced in hours — completely bypassing even a very long, complex WiFi password. Many security guides recommend disabling WPS entirely.

Generate a WiFi QR code with your network name and password, save or screenshot the resulting image, and print it on a card for guests to scan — our generator produces this as a scannable image you can save directly.

128-bit encryption (AES-CCMP) is the standard for WPA3-Personal, which covers virtually all home and small-business networks. WPA3-Enterprise offers an optional 192-bit security suite (using GCMP-256) for organizations with stricter compliance needs, but that's not the default most people use.

WPA2 and WPA3-Personal both allow a passphrase of up to 63 ASCII characters (or exactly 64 hexadecimal characters, if entering the raw key directly).

TOTP (Time-based One-Time Password) generates a temporary code — usually 6 digits, refreshing every 30 seconds — from a shared secret key and the current time, per the RFC 6238 standard. It's the method used by apps like Google Authenticator and Authy.

Open Google Authenticator, tap the "+" button, choose "Scan a QR code," and point your camera at the code shown by the service you're setting up 2FA for.

Most authenticator apps offer a "manual entry" or "enter a setup key" option — you'll type in the Base32-encoded secret (something like JBSWY3DPEHPK3PXP) directly instead of scanning. Our 2FA / TOTP QR Generator shows both the QR code and the raw secret so either method works.

Use the backup/recovery codes you were given when you first set up 2FA, or go through the service's account-recovery process. This is exactly why it's worth saving backup codes somewhere safe the moment you enable 2FA — before you need them.

Yes, generally. SMS codes are vulnerable to SIM-swapping attacks and interception via SS7 network vulnerabilities, while an authenticator app's codes are generated locally on your device and never transmitted over the phone network.

It's a standard URI format that packages everything an authenticator app needs — the account label, issuer name, secret key, algorithm, digit count, and refresh period — into one scannable link, typically embedded in a QR code.

Base32 encodes binary data using a 32-character alphabet (A–Z and 2–7), avoiding characters that are easy to confuse when typed by hand or scanned — which is why TOTP secrets are represented this way instead of in raw binary or hexadecimal.

Yes — scanning the same QR code or secret into multiple authenticator apps produces identical, synchronized codes on every device. That's useful as a backup, but it also means anyone with a copy of that secret can generate valid codes too, so treat the secret itself like a password.

HOTP (HMAC-based One-Time Password) generates a new code each time a counter increments, typically on a button press. TOTP generates a new code based on the current time instead of a counter — usually every 30 seconds — which is why it's the more common choice today.

A standard TOTP code is valid for 30 seconds, though most servers accept a small window before and after that to tolerate minor clock drift between your device and theirs.

Microsoft Authenticator supports standard TOTP QR code scanning just like Google Authenticator or Authy, and additionally offers passwordless push-notification sign-in for Microsoft accounts specifically.

Only if the tool generates the secret and QR code entirely in your browser, with no network request involved — otherwise your 2FA secret could be exposed to whoever operates the server. Our generator uses the Web Crypto API locally and never transmits anything.

Backup codes are a set of one-time-use recovery codes issued when you first enable 2FA on an account, meant to be stored somewhere safe so you can still log in if you lose your phone or authenticator app.

Use a batch generator to produce several unique, high-entropy passwords in one go, rather than generating and copying them one at a time. Our Batch Password Generator can create up to 50 at once, each with its own strength badge.

Administrators typically script bulk temporary-password creation — using tools like PowerShell, dedicated onboarding software, or a browser-based batch generator — before importing the results into a directory service or account-provisioning system.

Many batch generator tools let you export a structured file (like CSV) with usernames paired to generated passwords. Our tool currently supports copying the full batch or downloading it as a plain-text file.

Configure a generator for high-length alphanumeric output (skip symbols, since most API key formats don't use them) and generate a batch — the same underlying randomness used for passwords works well for API keys.

A batch generator typically tracks everything it has already produced (often in a Set, a data structure that only allows unique values) and checks each new password against that list before adding it to the results.

CSV and JSON are the most common choices for importing credentials into databases, directory services, or password managers, since both are widely supported structured formats.

Yes — this is a common use case for school and organization IT staff during onboarding, generating a batch of temporary passwords to distribute and requiring each user to change theirs on first login.

Very fast — modern JavaScript engines can generate thousands of unique, high-entropy passwords in a fraction of a second, entirely on your own device.

An unencrypted file full of passwords sitting on a local disk is a real risk if that device is ever lost, stolen, or compromised. Encrypt the file, store it somewhere access-controlled, or — better — delete it as soon as you've moved the passwords into a proper password manager.

Yes — a good batch tool lets you toggle uppercase, lowercase, numbers, and symbols, and exclude ambiguous characters, applying the same settings consistently across every password in the batch.

Yes — switch to Passphrase mode before generating a batch to get multiple memorable, multi-word combinations instead of random character strings, all in one batch.

NIST SP 800-63B-4 (finalized in 2025) recommends a 15-character minimum for user-chosen passwords where systems support it, explicitly prohibits mandatory composition rules (like forcing a symbol or capital letter), forbids routine periodic password expiration unless there's evidence of compromise, and requires screening new passwords against breached-password and commonly-used-password lists.

PCI DSS v4.0 requires a minimum password length of 12 characters (8 characters if a system genuinely can't support more), a mix of letters, numbers, and special characters, and — notably different from NIST's compromise-driven approach — a default 90-day rotation schedule unless the organization uses continuous risk-based or zero-trust authentication instead.

ISO 27001's Annex A requires organizations to maintain a formal access control and authentication policy — covering password management, multi-factor authentication, and user responsibility — though the standard leaves the specific complexity rules to the organization's own risk assessment rather than mandating exact rules.

Favor length over forced complexity, require multi-factor authentication, screen new passwords against breached-password lists, encourage (or require) a password manager, and avoid routine forced resets unless you have evidence of compromise — this now matches current NIST guidance closely.

HIPAA's Security Rule requires healthcare organizations to implement administrative and technical safeguards for access control — including password management and authentication procedures — though it leaves the specific technical requirements up to the organization's risk analysis rather than dictating exact password rules.

Research found that forced periodic resets push people toward small, predictable variations of their existing password (like changing "Spring2025!" to "Summer2025!") rather than genuinely new, unrelated ones — which, in practice, made accounts easier to guess rather than harder.

GDPR's Article 32 requires "appropriate technical and organisational measures" to protect personal data, without naming specific password rules directly — in practice, this is generally implemented as strong password policies plus measures like salted password hashing and multi-factor authentication.

Configure the Default Domain Policy (or a Fine-Grained Password Policy) under Computer Configuration → Windows Settings → Security Settings → Account Policies → Password Policy in Group Policy Management to set length, complexity, and lockout rules.

SOC 2 doesn't mandate specific password rules directly — instead, it requires an organization to demonstrate, under its chosen Trust Services Criteria, that it has effective access controls in place, which in practice usually includes documented password requirements and multi-factor authentication for sensitive systems.

A banned (or blocked) password list is a set of common words, dictionary terms, the organization's own name, and known breached passwords that the system automatically rejects when a user tries to set or reset their password. Our own tools use a 10,000-entry common-password list for exactly this kind of check.

A short maximum length (like 16 or 20 characters) prevents users from adopting long, secure passphrases — actively working against current best practice. NIST recommends systems support passwords of at least 64 characters for this reason.