Generate a password worth using

How passwords are generated#

Everything happens in your browser. Characters are chosen with the browser's cryptographic random number generator (crypto.getRandomValues), and the selection removes modulo bias, the subtle skew that makes some characters slightly likelier than others when a random number is simply divided down to a range. Nothing is transmitted, and nothing is stored, so closing the tab erases it.

• Random passwords draw from the sets you tick: lowercase, uppercase, digits and symbols. Look-alike characters (l, I, O, 0, 1) are left out, and so are quotes and backslashes, which shells and spreadsheets mangle. The length runs from 8 to 64.
• Passphrases join three to ten words from a list of 575 short words. That is about 9.2 bits per word, so a phrase needs more words than one built from a larger list. Five words give 46 bits, and eight give about 73.

Reading the strength meter#

The meter reports the real entropy of the generator's output, not a guess from how the text looks: the bits per character times the length. A string that merely appears random could have been guessed. This one was made by a process whose size is known.

The cracking time is stated as an offline attack: a fast hash, and an attacker trying 100 billion guesses a second, on average halfway through the search. Real sites should be slower to attack than that, because they hash passwords slowly and rate-limit logins, so the estimate leans cautious.

Using a generated password well#

1. Give every account its own password. One reused password turns any single breach into all of them.
2. Keep them in a password manager. A generated 20-character password is not something to remember, and it should not be.
3. Turn on two-factor authentication wherever it is offered, and start with your email.
4. Check an old password against known breaches with the breach check, which never sends the password.