How long should my password be?

Aim for at least 72 bits of entropy: roughly 12 random characters from all four classes, or a 5-word passphrase from the EFF list (about 52 bits) plus a digit and symbol for high-value accounts. The strength meter shows the bits for your current settings.

What is a diceware passphrase?

A sequence of words chosen uniformly from a fixed list. The EFF short list has 1,296 words (6^4), so each word adds about 10.3 bits — the same odds as rolling four dice. Passphrases are far easier to remember and type than random symbols of equal strength.

How is the crack time calculated?

Average guesses = 2^(entropy − 1). Offline assumes 10 billion guesses per second (a GPU rig against a fast unsalted hash); online assumes 1,000 per second against a throttled login endpoint. Real services using bcrypt or Argon2 are thousands of times slower to attack.

What are "ambiguous characters"?

Characters that look alike: `0/O`, `1/l/I`, `|`. Excluding them reduces transcription errors without meaningfully hurting entropy.

Does "require every class" weaken the password?

Slightly, in theory, because it removes strings that lack a class — but the generator uses rejection sampling so the remaining strings stay uniformly distributed, and the loss is a fraction of a bit for any length above 8.

Password Generator

Generate cryptographically secure passwords in four modes: random characters with per-class control, custom charsets and exclusions; EFF-wordlist passphrases (diceware) with separators, capitalisation and extra digits/symbols; numeric PINs; and pronounceable syllable strings. Every result shows its entropy and how long an offline (10 billion guesses/s) or online (1,000 guesses/s) attack would take on average. Sampling uses rejection sampling on `crypto.getRandomValues`, so it is unbiased. Nothing leaves your browser.

Runs locally in your browser

StrengthExcellent≈127 bits

Generated

Fix the options above to generate passwords.

Length

20 chars

Entropy

127.2 bits

Pool

82 chars

Offline crack

≈10¹⁹ years

Online crack

≈10²⁶ years

Length20

Custom character setReplaces the classes entirely. Duplicates are ignored.

Exclude charactersHandy for systems that reject certain symbols.

Generateat once (max 100) · ⌘/Ctrl+Enter regenerates

UUID Generator & Inspector

Generate UUID v1/v3/v4/v5/v6/v7, ULIDs and nanoids in bulk, inspect any UUID, and validate lists.

Hash Generator

MD5, SHA-1, SHA-256/384/512, SHA-3, CRC32 and xxHash32 for text, lines and files — with verify and checksum export.

Random Number Generator

Random integers and decimals, normal/exponential/weighted distributions, dice rolls, coin flips, and list shuffles or raffle picks.

Bcrypt Generator / Checker

Hash passwords with bcrypt, verify hashes, generate salts and benchmark cost factors on your device.

How to use Password Generator

1Pick a mode: Random, Passphrase, PIN or Pronounceable.
2Adjust length or word count with the slider, and toggle character classes, separators or extras.
3Read the strength meter and crack-time estimate, then copy a single line or all results as text, JSON or CSV.
4Press ⌘/Ctrl+Enter to regenerate; Undo restores the previous set.

About Password Generator

Password Generator is part of FizzKit — a collection of focused developer and ad-tech tools. Because everything runs locally, it works offline once loaded and never exposes your data to a remote server.

Frequently asked questions

Yes. Every character and word is drawn with `crypto.getRandomValues` using rejection sampling, so no value is more likely than another. The generator never falls back to `Math.random`.

Related tools