Password Generator

How this works, and why it matters

Every password is generated in your browser using crypto.getRandomValues(), the platform's cryptographically secure random source. Nothing is transmitted, nothing is logged, and no server ever sees the result. You can confirm that by disconnecting from the network — the page keeps working.

That is not a small detail. A generator that produces passwords server-side has, by definition, seen every password it made for you.

Entropy, in plain terms

Entropy measures how many guesses an attacker needs, expressed in bits. Each additional bit doubles the work. Roughly:

• Under 50 bits — falls to a determined offline attack against a fast hash.
• 50–70 bits — reasonable for accounts protected by rate limiting and MFA.
• 70–100 bits — strong. Sensible for anything that matters.
• Over 100 bits — beyond any foreseeable brute-force capability.

Length buys far more than complexity does. A 20-character lowercase-only password beats a 10-character one using every symbol on the keyboard, and it is easier to type.

Passphrases

Six random words from a list of 4,096 give 72 bits of entropy and are dramatically easier to type on a phone or read aloud down a phone line — which matters more than people admit when you are talking a client through a wifi key. The catch is that the words must be randomly chosen. Words you picked yourself are worth a fraction of the entropy, because you did not pick them randomly.

What actually protects accounts

In order of impact: a password manager so every password is unique, MFA on everything that supports it, and length. Forced ninety-day rotation is not on that list — NIST dropped that guidance years ago, because in practice it produces Summer2024! becoming Autumn2024!.

If you are working out password policy for a business rather than a single account, that is part of cybersecurity consulting.