Quick Takeaway
This tool uses the browser's native `crypto.getRandomValues()` Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). No passwords are ever sent to or logged on any server. For maximum protection against quantum and dictionary attacks, use a 16+ character password or a 5-word passphrase (yielding 80+ bits of entropy).
How to Create truly Secure Passwords and Passphrases
Password strength is measured in mathematical entropy (bits). Every additional character exponentially increases the computational effort required for brute-force attacks. A 16-character random password containing uppercase, lowercase, digits, and symbols would take modern supercomputers billions of years to guess.
Password Length vs Estimated Brute-Force Crack Time
| Password Type & Length | Character Pool Complexity | Entropy | Estimated Crack Time |
|---|---|---|---|
| 8 Characters (Numbers only) | Numbers only | 27 bits | Instant (< 1 millisecond) |
| 8 Characters (Mixed Case + Digits + Symbols) | Complex | 53 bits | approx. 8 hours |
| 12 Characters (Complex) | Upper, lower, digits, symbols | 79 bits | approx. 200 years |
| 16 Characters (Complex) | Upper, lower, digits, symbols | 105 bits | approx. 1 trillion years |
| 5-Word Diceware Passphrase | Dictionary words with hyphen | 65 bits | approx. 3,000 years |