Password Generator

How to use the password generator

A password appears in the bar at the top as soon as the page loads — there's nothing to configure first. From there:

• Drag the length slider to make the password longer or shorter.
• Toggle lowercase, uppercase, digits and symbols on or off to change what the password is built from — the password and its entropy update immediately, with no button press needed.
• Click "New" any time to draw another password from the same settings.
• If a site rejects certain characters, turn on "Shell-safe" or "Unambiguous" under named alphabets to drop the ones that cause trouble.
• To match one specific website's password policy exactly, type its domain into "Match a site" and pick it from the list — the length, required character types and any repeat limits switch to that site's real rules automatically.
• Use "Copy" to copy the result to your clipboard, and "Hide" to keep it off screen.
• To check a password you already have instead of generating a new one, paste or type it into the same bar — the tool switches into checking mode and shows its real strength and crack time instead.

Why length beats composition rules

Every password's strength is a count of how many strings a generator could have produced, turned into bits: log₂(N). Requiring "at least one digit" makes that count smaller, not bigger, because it removes every string that has no digit. The usual way generators satisfy such a rule — draw freely, then overwrite a random position with a required character — also isn't uniform over what's left, which means the entropy number printed next to it doesn't describe the password actually produced. This tool draws uniformly from the exact set of strings that satisfy whatever constraints are active, so the number shown is always the number the password actually has — this doubles as a password entropy calculator, not just a generator, since every constraint you turn on updates the bit count live.

Why crack time is split by algorithm

"Time to crack" is meaningless without saying what's being attacked. The same password, against the same twelve-GPU rig, takes under a minute to crack if it's protected by MD5 and close to a century if it's protected by bcrypt — a difference of six orders of magnitude that a single crack-time figure hides. Rates here come from a single cited hashcat benchmark (see the caption under the table), scaled to an assumed rig, assuming an average-case guess of half the keyspace — stated so every number can be reproduced, not just believed.

What checking a password actually costs

Naive strength meters count character classes and multiply: a password with letters, a digit and a symbol "must" be strong. That is exactly how Tr0ub4dor&3 gets rated 72 bits by tools that only count classes, when its real cost — a dictionary word, a well-known leetspeak substitution, and two extra characters — is 28. Pasting a password into the bar above prices it the same way the generator prices its own output: the cheapest pattern found in every stretch of the password, in bits, so the two halves of this page never contradict each other.

Common use cases

• Generating a new password for an account, with the entropy behind the claim visible
• Meeting one specific website's password policy on the first try, without a rejected form
• Checking whether an existing password is actually strong, or just looks strong
• Understanding why a security team's composition rules do less than the length does