Password security assessment and generation engine
Password Generator & Strength Checker Password generator and strength analysis tools
Generate strong passwords or Passphrase, and instantly analyze password security, entropy value and cracking difficulty. Understand the math behind passwords and build truly secure protection.
4128
Advanced options
QR Code
Scan the QR Code to get the password (pay attention to safety around you)
generated password
Click Generate
intensity
-- bits
WeakFairGoodStrongVery Strong
⛏ Offline cracking time (estimated)
--
*Break times are theoretical estimates, assuming the attacker uses GPU acceleration (10⁹ times/second). The actual time depends on the attacker's hardware and methods.
Character Pool
A-Z
a-z
0-9
!@#$%
Total Pool
94 characters
Estimated Entropy
-- bits
cryptanalysis
capital letters--
lowercase letters--
numbers--
symbol--
length--
Repeat characters--
consecutive characters--
Frequently Asked Questions (FAQ)
How to create a secure password?
A secure password should have the following characteristics:
• long enough: At least 12 characters, 16 or more characters recommended
• Messy enough: Mix uppercase, lowercase, numbers and symbols
• Not repeated: Use a different password for each website
• Irregular: Avoid common patterns such as birthday, name, consecutive keyboard keys, etc.
Using this tool's password mode or Passphrase mode, you can easily generate secure passwords that meet the above conditions.
• long enough: At least 12 characters, 16 or more characters recommended
• Messy enough: Mix uppercase, lowercase, numbers and symbols
• Not repeated: Use a different password for each website
• Irregular: Avoid common patterns such as birthday, name, consecutive keyboard keys, etc.
Using this tool's password mode or Passphrase mode, you can easily generate secure passwords that meet the above conditions.
Why not reuse passwords?
If a website were to be compromised, the attacker could obtain the password (or password hash) you used on that website. If you use the same password on other websites, an attacker can try to log into your other accounts. This is called Credential Stuffing.
According to the Verizon Breach Investigation Report, more than 80% of hacking incidents are related to weak passwords or password reuse. It is recommended to use a password manager (such as Bitwarden, 1Password) to generate and store unique and strong passwords for each website.
According to the Verizon Breach Investigation Report, more than 80% of hacking incidents are related to weak passwords or password reuse. It is recommended to use a password manager (such as Bitwarden, 1Password) to generate and store unique and strong passwords for each website.
What is the difference between Password and Passphrase?
Password consists of random characters, for example
A passphrase consists of several common words, such as
• Password: difficult to remember, difficult to type, high density entropy
• Passphrase: easy to remember, easy to type, accumulates entropy by length
While both can be very safe if designed properly, Passphrase is more suitable for use in situations where human memory is required.
k8J#mP2&xL9$qR, high security but difficult to remember.A passphrase consists of several common words, such as
river-orange-coffee-window, trading length for safety. The famous xkcd comic (#936) illustrates how a passphrase such as "The Correct Toilet Battery Staple", although composed of simple words, is long enough to have extremely high entropy.• Password: difficult to remember, difficult to type, high density entropy
• Passphrase: easy to remember, easy to type, accumulates entropy by length
While both can be very safe if designed properly, Passphrase is more suitable for use in situations where human memory is required.
What is Entropy?
Entropy is an indicator used to measure uncertainty in information theory, and its unit is bit. In cryptography, entropy represents the logarithm of the number of attempts required to crack a password.
Calculation formula:
Where R is the character pool size and L is the password length.
• 50 bits — Brute force in minutes using GPU
• 60 bits — may take hours to days
• 70 bits — may take years
• 80 bits — very secure, thousands of years away from current technology
• 128 bits — difficult to crack even with a quantum computer
It is generally recommended that the password entropy value should be above 70 bits.
Calculation formula:
Entropy = log₂(R^L) = L × log₂(R)Where R is the character pool size and L is the password length.
• 50 bits — Brute force in minutes using GPU
• 60 bits — may take hours to days
• 70 bits — may take years
• 80 bits — very secure, thousands of years away from current technology
• 128 bits — difficult to crack even with a quantum computer
It is generally recommended that the password entropy value should be above 70 bits.
Are password managers safe?
Password managers (such as Bitwarden, 1Password, KeePass) are by far the most recommended way to manage passwords. They use a master password to encrypt all of your password database. As long as the master password is strong enough and has not been leaked, password managers are very safe.
Password managers provide better security and convenience than reusing the same passwords everywhere or writing them on sticky notes. It is recommended to use this tool to generate a 4-5 word Passphrase as your master password.
Password managers provide better security and convenience than reusing the same passwords everywhere or writing them on sticky notes. It is recommended to use this tool to generate a 4-5 word Passphrase as your master password.
What are brute force and dictionary attacks?
• Brute Force: Try all possible character combinations. This is the most comprehensive but also the most time-consuming attack method. Defense: Increase password length and character pool size to increase entropy.
• Dictionary Attack: Use a list of common passwords to try. Many weak passwords such as
• Rainbow Table attack: Pre-calculated hash value comparison table. Defense: Websites should use Salt to defend against such attacks.
• Dictionary Attack: Use a list of common passwords to try. Many weak passwords such as
password123 or admin2024 Can be cracked within seconds. Defense: Avoid using any dictionary words or common patterns.• Rainbow Table attack: Pre-calculated hash value comparison table. Defense: Websites should use Salt to defend against such attacks.
The Complete Guide to Password Security
Best practices for establishing secure passwords
- Length trumps complexity: A 16-character plain lowercase password (75 bits) is more secure than an 8-character signed password (52 bits)
- One password for each site: Use a password manager to generate unique passwords for each website
- Enable 2FA/MFA:Two-factor authentication can greatly improve account security
- Regular replacement: It is recommended to change passwords for important accounts (email, bank) every 3-6 months
- Avoid personal information: Do not use personal information such as birthday, phone number, name, etc. in your password
- Check for leaks: Regularly use Have I Been Pwned to check whether your account has been compromised.
Entropy calculation example
Plain lowercase 8 characters
38.0 bits
Can be cracked in minutes
Uppercase and lowercase + numbers 10 characters
59.5 bits
may take several days
Complete character set 16 characters
95.3 bits
millions of years
5 words Passphrase
~65 bits
Hundreds of years (assumed 7776 vocabulary)
Password security level recommendations
According to NIST SP 800-63B and OWASP recommendations:
- general website: Entropy value ≥ 50 bits, length ≥ 10 characters
- Important accounts (email, bank): Entropy value ≥ 70 bits, length ≥ 14 characters
- Master Password: Entropy value ≥ 80 bits, it is recommended to use Passphrase
- Admin/SSH key: Entropy value ≥ 100 bits