Encode Bench › Password Generator
Password Generator
Generate a random password or a word-based passphrase. Each result shows its entropy in bits, which is the only honest measure of strength, rather than a coloured bar.
● Runs locally. What you paste never leaves this page.
Entropy is the only honest strength measure
Password strength meters that show a coloured bar are mostly measuring whether you used a capital letter. The meaningful number is entropy in bits, which is the base-two logarithm of the number of equally likely passwords the generation process could have produced. Each extra bit doubles the work an attacker must do.
| Entropy | Practical meaning |
|---|---|
| Under 40 bits | Falls to a determined offline attack quickly |
| 60 bits | Adequate for accounts with rate limiting |
| 80 bits | Comfortable for anything important |
| 128 bits | Beyond brute force for the foreseeable future |
Entropy only counts if the generation really is random. A password you invented has far less entropy than its length suggests, because human choices cluster heavily: predictable substitutions, a capital at the front, a digit and an exclamation mark at the end. Attackers model those patterns explicitly.
Passphrases
Six words drawn randomly from a list of roughly a thousand gives about 60 bits, comparable to a ten-character random password, and it is far easier to type on a phone or read aloud. The strength comes entirely from the random selection, so choosing words yourself destroys it: a memorable phrase from a song or book has almost no entropy at all, because that phrase is in the attacker's corpus too.
Length is what makes a passphrase work, so systems that cap password length at twelve characters actively prevent good practice. A cap that low is also a strong hint that the password is being stored in a way it should not be.
Where randomness comes from here
Every character and word is selected with crypto.getRandomValues,
the browser's cryptographically secure generator, using rejection sampling to
avoid the modulo bias that a naive remainder introduces. Nothing is generated on
a server, nothing is transmitted, and nothing is logged. Close the tab and the
values are gone.
Practical advice
- Use a password manager and let it hold long random passwords. The hardest part of good password practice is not generating them, it is not reusing them, and only a manager solves that.
- Uniqueness beats complexity. A reused strong password is worse than a unique moderate one, because credential stuffing tries known pairs everywhere.
- Excluding look-alikes costs a little entropy and is worth it only when a password will be transcribed by hand or read over the phone.
- Turn on two-factor authentication where it is offered. It defends the case where the password is compromised through no fault of yours.
Questions
Are these passwords generated on a server?
No. Generation happens entirely in your browser using its cryptographic random source. Nothing is transmitted, stored or logged, and the values disappear when you close the tab.
How long should a password be?
Aim for at least 16 random characters, or six randomly chosen words for a passphrase. Both land around 60 to 100 bits of entropy, which is beyond practical offline attack for ordinary accounts.
Is a passphrase weaker than a random password?
Not if the words are chosen randomly and there are enough of them. Six random words from a thousand-word list is about 60 bits, comparable to a ten-character random password and far easier to type.
Why does the tool show bits instead of a strength bar?
Because bits of entropy is a real measurement of how many possibilities an attacker must search, whereas a coloured bar mostly reports whether you included a capital letter.
Should I exclude look-alike characters?
Only when the password will be read aloud or typed from paper. It removes ambiguity between characters like l, I and 1, at the cost of slightly reducing the alphabet and therefore the entropy.