Cryptographic Password Generator & Entropy
Generate cryptographically secure passwords and Diceware passphrases with client-side entropy calculation and brute-force crack time estimates.
NIST & OWASP Password Entropy Benchmarks
| Entropy (Bits) | Strength Rating | Offline Crack Resistance |
|---|---|---|
| < 36 Bits | Very Weak | Cracked in seconds to minutes via basic hashcat |
| 36 - 59 Bits | Reasonable | Resistant to online attacks; vulnerable to leaked database hashes |
| 60 - 84 Bits | Strong | Secure against dedicated multi-GPU cracking rigs (Centuries) |
| 85 - 128+ Bits | Military / Cryptographic | Mathematically uncrackable before the heat death of the universe |
🔐 Why Passphrases Beat Complex Short Passwords
A 4-word Diceware passphrase (e.g. correct-horse-battery-staple) has 52 bits of pure entropy and is trivial for human memory to retain, whereas an 8-character symbol mess (e.g. Tr0v$b!) has only 28 bits of entropy and is easily guessed by modern cracking rigs in under 3 days.
About this tool
How to use it
- Select your generation format: Random Characters, Memorable Diceware Passphrase, or Numeric PIN.
- Adjust the character length slider and toggle uppercase, lowercase, numbers, and symbols.
- Inspect the real-time Shannon Entropy (in bits) and brute-force crack time estimates.
- Click 'Copy Password' to copy the secure key to your clipboard without leaving your device.
Why it matters
Web-based password generators that transmit data over networks present serious privacy risks. By utilizing the browser's native window.crypto.getRandomValues() CSPRNG (Cryptographically Secure Pseudo-Random Number Generator), passwords are generated 100% offline in device memory with zero telemetry or transmission.
When to use it
Use this tool when creating new master passwords, provisioning Wi-Fi router WPA3 keys, configuring database API secrets, or generating memorable passphrases for cryptocurrency cold wallets.
Good to know
Shannon entropy formula: H = L × log2(R), where L is password length and R is the character pool size. 128 bits of entropy is mathematically impossible to crack before the universe ends.
Common questions
What makes a password cryptographically secure?
A secure password uses true non-deterministic cryptographic randomness (CSPRNG) from hardware entropy pools, possesses at least 64 to 80 bits of Shannon entropy, and is never reused across services.
Are passwords generated here sent to a server?
No. The entire generation and entropy scoring algorithm runs 100% client-side inside your browser. No strings are ever transmitted over the network or saved anywhere.
Why are Diceware passphrases recommended by NIST?
NIST Special Publication 800-63B recommends long passphrases (e.g. 4+ random dictionary words) because human brains can effortlessly memorize them without writing them down, while maintaining high cryptographic entropy against brute-force attacks.
What is considered a safe password length?
For everyday website logins, 16 characters is the recommended baseline. For critical accounts (password managers, banking, root server SSH keys), use 24 to 32 characters or an 80+ bit passphrase.