Why Random Beats Clever
Attackers don't guess passwords the way people imagine. Cracking rigs test tens of billions of combinations per second, starting with every leaked password ever published, every dictionary word, every name-plus-year pattern, and every keyboard walk like qwerty123. A password that feels clever to a human — a pet's name with an exclamation point, a birthday in reverse — sits comfortably inside those first few billion guesses. A truly random 16-character password does not: it lives in a space of roughly 1031 possibilities, which is beyond the practical reach of any hardware on earth.
That is the entire trick. You don't need an unguessable idea; you need randomness and length. This generator uses your browser's Web Crypto API — the same cryptographic random source password managers use — so every character is genuinely unpredictable.
Password Strength at a Glance
Strength is measured in bits of entropy — each additional bit doubles the number of possibilities an attacker must try. Here is how length and character choices translate to real-world resistance (assuming an offline attack at 100 billion guesses per second):
| Password | Entropy | Time to crack |
|---|---|---|
| 8 chars, lowercase only | ~38 bits | under 3 seconds |
| 10 chars, mixed case + numbers | ~60 bits | ~4 months |
| 12 chars, all character types | ~78 bits | ~96,000 years |
| 16 chars, all character types | ~104 bits | ~6 trillion years |
| 20 chars, all character types | ~130 bits | longer than the universe has existed |
The jump from 12 to 16 characters costs you nothing when a password manager is doing the remembering — but it multiplies an attacker's workload by roughly 67 million. Curious about a specific pattern? Try the password strength checker, which does the same math live (and never transmits what you type).
Three Rules That Do Almost All the Work
One account, one password. Reuse is how a forum breach becomes a bank problem: attackers replay leaked email-password pairs against every major site within hours ("credential stuffing"). Unique passwords contain the damage of any single breach.
Let a manager remember them. A reputable password manager stores unlimited random passwords behind one strong master passphrase — build that one memorable secret with our passphrase generator. Autofill also quietly protects you from phishing, because the manager refuses to fill credentials on a look-alike domain.
Turn on two-factor authentication. Even a perfect password can be phished; a second factor means a stolen password alone isn't enough. An authenticator app beats SMS where you have the choice.
For the full playbook — including what actually happened to the "change your password every 90 days" rule — read our guide to creating strong passwords.