Password generator

How the result is calculated

1. The password is drawn from the cryptographic random source of your browser (crypto.getRandomValues). Each character is picked with equal probability from the characters you allow, and draws that would favour some characters are thrown away.
2. Every kind of character you turn on appears at least once: a password that lacks one is thrown away and drawn again, so all valid passwords stay equally likely.
3. The strength in bits is the base-2 logarithm of the number of possible passwords. The number is counted exactly, including the rule that every kind of character appears.
4. The time to guess is half of all the possibilities (the average) divided by the guesses an attacker makes per second.
5. The strength bands are ours, not a standard: below 60 bits is weak, from 60 to 100 bits good, from 100 bits very strong.

Assumptions and limits

• The strength holds only for a password made by this generator, not for one you thought up or changed by hand.
• The speeds are benchmarks of one graphics card. An attacker can use many cards, and a service can use a slower hash or limit the attempts, so the real time can be shorter or much longer.
• The bcrypt benchmark uses 32 iterations (cost 5). Services often use more, which slows an attacker down further.
• The generator does not check whether a password has leaked, and it does not know the rules of a particular site, such as symbols it rejects.
• Attacks on the person (phishing, malware) are not in the numbers, and a strong password does not protect against them.

The online speed (10 guesses a second) is our example. The offline speeds are published benchmarks: MD5 215.8 GH/s and bcrypt 255.3 kH/s on one NVIDIA RTX 5090 (hashcat v6.2.6).

Data sources and the period they hold for

Every number a calculator starts with or computes from comes from one of the sources below. Series names are given as the publisher names them. Each row shows the period the data refer to and, where we record it, the day we downloaded them. Official data can be months old when they are published, so check the current figure before you decide.

Official

Published by a central bank, a statistical office, the European Union or another public body.

Research or industry data

A dataset of a university, an index provider, an industry association or a data vendor.

Reported

A figure of an official body that we know only from the press and did not check in the primary source. Treat it as approximate.

Example

A round number of ours, not a statistic. Replace it with your own.