Realistic Estimation
We use the zxcvbn library developed by Dropbox, which analyzes real-world attack patterns, dictionary words, and common substitutions — not just character counts.
100% Private
Generation happens entirely in your browser — your password is never transmitted, stored, or logged. The optional breach check sends only a partial hash, never your actual password.
Instant Analysis
Real-time strength feedback as you type. Covers offline dictionary attacks, brute-force scenarios, and pattern recognition simultaneously.
Why this generator defaults to length over complexity
Every password below is built from a cryptographically secure random number generator (CSPRNG) — the same class of randomness required for cryptographic keys, not the simpler pseudo-random functions used for things like shuffling a deck of cards in a game. That distinction matters: a "random-looking" password from a weak RNG can sometimes be predicted by anyone who figures out the underlying algorithm and its seed. A CSPRNG can't be, even in principle.
The defaults favor length over forced complexity, matching NIST SP 800-63B-4's current guidance (see Sources below): a 16+ character password from a full character set is dramatically harder to crack than an 8-character one stuffed with a mandatory symbol and digit — and it's usually easier to type correctly, too. Passphrase mode goes a step further, building from the EFF's Diceware wordlist — each word adds about 12.9 bits of entropy, so a five-word passphrase already beats most "complex" 12-character passwords while staying genuinely memorable.
Where this tool's guidance comes from
This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source.