How it works
Passwords are built in your browser with crypto.getRandomValues(), the operating system’s cryptographically secure random generator. We use rejection sampling so every character is equally likely. The page makes no network request when you generate a password, and nothing is stored.
How long should a password be?
Entropy measures how hard a random password is to guess. Each character drawn from a set of N symbols adds log₂(N) bits.
| Length | Character set | Entropy |
|---|---|---|
| 12 | letters + digits (62) | ~71 bits |
| 16 | letters + digits + symbols (~89) | ~103 bits |
| 20 | letters + digits + symbols (~89) | ~129 bits |
For accounts protected by a password manager, 16–20 random characters is plenty. For a master password you must type, consider a long passphrase of five or more random words.
Good practice
- Use a different password for every account. Reuse turns one breach into many.
- Store passwords in a reputable password manager.
- Turn on two-factor authentication, preferably passkeys or an authenticator app rather than SMS.