Password generator with entropy

About this tool

Generates random passwords to your length and character-class rules, using the browser's crypto with rejection sampling so that no character is more likely than another. It shows the entropy in bits and estimates crack times against four classes of attacker, from a throttled login form to an offline GPU rig.

Good for

• Generating passwords to store in a password manager
• Service-account and database credentials that have awkward character rules
• Showing a colleague why length beats complexity

Not for

• Passwords you need to memorise: use diceware
• Treating the crack times as guarantees: they assume the attacker knows your generator settings and nothing else, and a phished or reused password ignores all of them

Further reading on mikepreston.org

• Passwords, Authentication, and Why We're Still Getting It Wrong
• Publishing a Hash of Someone's Email Is Publishing Their Email
• Stop Putting Secrets in Environment Variables