Skip to main content
Kalcufy

Password Generator

Generate strong random passwords, memorable passphrases, and secure PINs with real-time strength analysis and crack time estimates.

Reference table

Password LengthYour PasswordStrengthEntropy
4inzO🔴 Very Weak26 bits
5GQ6%m🔴 Very Weak32.5 bits
10TmxbKhE5[D🟡 Fair65.1 bits
15n0y0r*8r3=7g(28🟢 Strong97.6 bits
20kD`Rnb_LhP_A$gRFtOTK🟣 Very Strong130.2 bits
25i~@+DUCsci[B.t3~cW?7^Pu1u🟣 Very Strong162.7 bits
30`t1DRy;C]1L`^oUew=DxZFmEN`q{90🟣 Very Strong195.2 bits
40XU#x:b4e_dQ6ymX0*g&([-XlBGf/^FT]$FUjo/|k🟣 Very Strong260.3 bits
50K.?$z:Z08_)~vX1)]F=2Xb4R.#&1DR>|ePp*sgCJY%`5qOv3kp🟣 Very Strong325.4 bits
60.Fs9iFXdn46_r~3b*Bf(r3u*H!){r;xz(.3]PXFy`r:rg@lp[|V8f}o(JA-/🟣 Very Strong390.5 bits
70Vtd(jOZ-5i2,2@ZOA;SguE?.0u9wO]:]/q%[8C^8Qdw)u~uBw<&;o#6T^S=8nF7%tiFcsX🟣 Very Strong455.5 bits
75Q|wpY(gY~PF96!T=b2vbXlvI@)t=j12j>e.l$o:5JUabniaFB~[pZ7=rvt6ae[jVn@LS6{bE|Zk🟣 Very Strong488.1 bits
80dW&gU8/2W.i>uCLO[J+qUk.`Q9=`=Vn-QX7+:?$SciGXg-(5(Ka~|R8AX`GR1r`F<sIS+DC=TxD)B{BZ🟣 Very Strong520.6 bits
90y7C%zOs11N?$HnGRWEPGQQ#;BqRyCmZ40>mD]t,hklx)nkq1m)4C!|bKOb8m}DbeEtES?<0qp{-?Q_OLn73-suLqJS🟣 Very Strong585.7 bits
100PgM!?F:(1P,;k{~u7`n:MU)n9}-X!)_Q059{rQ9[h14(-6@;Xjr}@BZYz-jEF>>$+G)o^s}v}BU8w+M9q1(/XgbD%g;B|s;-rN^D🟣 Very Strong650.8 bits

Password Security Tips

  • Use 16+ characters — each extra character makes your password exponentially harder to crack.
  • Never reuse passwords across sites — one breach exposes all accounts sharing that password.
  • Passphrases like Apple-Brave7-Chess-Delta are both strong and memorable.
  • Enable two-factor authentication (2FA) even with strong passwords for critical accounts.

What Makes a Password Strong?

A strong password has three essential qualities: length, complexity, and uniqueness. Length is the single most important factor — each additional character multiplies the number of possible combinations exponentially. A 12-character password using all character types (lowercase, uppercase, numbers, symbols) has about 475 trillion trillion possible combinations, while an 8-character password has only 6 quadrillion — roughly 79 billion times fewer possibilities. Complexity comes from using a diverse character set: lowercase letters provide 26 options per position, adding uppercase doubles it to 52, digits bring it to 62, and symbols push it to 94 or more. But length trumps complexity every time: a 20-character lowercase-only password (2.0 × 10²⁸ combinations) is vastly stronger than an 8-character password using all character types (6.1 × 10¹⁵ combinations). Uniqueness means never reusing a password — if one service suffers a data breach, attackers will try that same password on every other site you use through credential stuffing attacks.

How Password Entropy Works

Entropy, measured in bits, quantifies the randomness in a password. The formula is: entropy = length × log₂(charset_size). A 16-character password using the full 94-character set (lowercase + uppercase + numbers + symbols) has about 104.8 bits of entropy. Every additional bit of entropy doubles the number of guesses an attacker needs to make. For context: 40 bits of entropy can be cracked in seconds by modern hardware, 60 bits takes hours, 80 bits takes years, and 128+ bits is considered uncrackable with current technology. Passphrases derive their entropy differently — from a word list size raised to the power of the word count. A 4-word passphrase from a 200-word list has log₂(200⁴) ≈ 30.6 bits, while 5 words gives ~38.2 bits. Adding capitalization, separators, and random numbers significantly boosts passphrase entropy. The key insight: entropy must come from truly random selection. A human choosing 'Password123!' might use uppercase, lowercase, numbers, and symbols, but it has near-zero effective entropy because it follows an extremely predictable pattern.

Password Best Practices

  • Use 16+ characters for passwords and 5+ words for passphrases — length is the strongest defense against brute force attacks.
  • Enable 2FA on all critical accounts (email, banking, social media) — even a compromised password cannot bypass a second factor.
  • Use a password manager to generate and store unique passwords for every account — humans cannot reliably remember dozens of strong passwords.
  • Never share passwords via email, text, or chat — these channels can be intercepted or stored in plaintext.
  • Check if your passwords have been exposed in data breaches using services like Have I Been Pwned (haveibeenpwned.com).
  • Avoid personal information in passwords — names, birthdays, pet names, and addresses are the first things attackers try.

Attack Methods & Crack Times

  • Online Throttled (100/hr): Web login forms with rate limiting — even short passwords survive days. Most sites use this.
  • Online Unthrottled (10/sec): APIs without rate limits — weak passwords fall in hours. Always add rate limiting.
  • Offline Slow Hash (10K/sec): bcrypt/Argon2 hashed database leaks — well-designed systems make each guess expensive.
  • Offline Fast Hash (10B/sec): MD5/SHA-1 hashed leaks — modern GPUs test billions of combinations per second.
  • Dictionary Attack: Tries common words, names, patterns first — 'Password123!' falls instantly despite mixed characters.
  • Credential Stuffing: Uses breached password lists on other sites — reused passwords enable cascading account compromise.

Password Strength Examples

Compare real password strengths

Weak vs Strong Passwords

  1. ❌ 'password123' → 0 bits entropy (dictionary word) → Cracked INSTANTLY
  2. ❌ 'Tr0ub4dor&3' → ~28 bits (common substitutions) → Cracked in SECONDS
  3. ⚠️ 'xK9#mL2$' (8 chars, all types) → 52.4 bits → Cracked in 6 hours (fast hash)
  4. ✅ 'aX7$mK9#pL2&nR5!' (16 chars) → 104.8 bits → 394 billion years (fast hash)
  5. ✅ 'Apple-Brave7-Chess-Delta' (passphrase) → ~45 bits → years (fast hash)
  6. ✅ 'Frost-Gleam4-Haven-Jewel-Light' (5 words) → ~55 bits → centuries

Length matters most. A 16-char password with all types is essentially uncrackable.

Entropy Math Example

  1. Password: 16 characters using lowercase + uppercase + numbers + symbols
  2. Character set size: 26 + 26 + 10 + 32 = 94 characters
  3. Entropy = 16 × log₂(94) = 16 × 6.55 = 104.8 bits
  4. Total combinations = 94¹⁶ = 3.7 × 10³¹
  5. At 10 billion guesses/sec: 3.7 × 10³¹ ÷ 10¹⁰ = 3.7 × 10²¹ seconds
  6. That's approximately 117 trillion years to try all combinations

Average crack time = half of total = ~59 trillion years. Your password is safe.

Frequently Asked Questions

How does this password generator work?

This tool uses cryptographic-quality randomness to generate passwords. For random passwords, it selects characters from your chosen character set (uppercase, lowercase, numbers, symbols) with equal probability. For passphrases, it randomly picks words from a curated 200-word list. For PINs, it generates random digits. All generation happens locally in your browser — no passwords are ever sent to any server or stored anywhere.

What password length should I use?

For random passwords, use at least 16 characters with all character types enabled. This gives over 104 bits of entropy, making brute-force attacks infeasible. For passphrases, use at least 4-5 words with a separator and number. For PINs, use 6+ digits — 4-digit PINs have only 10,000 combinations, which can be cracked in seconds. The general rule: longer is always stronger, and every extra character multiplies security exponentially.

What do the crack time estimates mean?

We estimate crack times for three scenarios: Online Throttled assumes 100 guesses per hour (typical web login with rate limiting). Offline Slow Hash assumes 10,000 guesses per second (a leaked database using bcrypt or Argon2). Offline Fast Hash assumes 10 billion guesses per second (a leaked database using weak MD5 or SHA-1 hashing, cracked on modern GPUs). The offline fast hash scenario is the most dangerous and most realistic for data breaches.

Is a passphrase better than a random password?

Passphrases and random passwords serve different needs. A 5-word passphrase like 'Frost-Gleam4-Haven-Jewel-Light' is easy to type and memorize, with decent entropy (~55 bits). A 16-character random password like 'aX7$mK9#pL2&nR5!' has higher entropy (~105 bits) but is harder to remember. If you use a password manager, choose random passwords for maximum security. If you need to memorize it (like a master password), use a long passphrase with 5+ words.

What is password entropy?

Entropy measures the randomness of a password in bits. It's calculated as: length × log₂(character_set_size). Higher entropy means more possible combinations and longer crack times. Key thresholds: under 40 bits is very weak (crackable in minutes), 40-59 bits is weak, 60-79 bits is fair, 80-99 bits is strong, and 100+ bits is very strong (essentially uncrackable with current technology). Each additional bit doubles the number of guesses needed.

Should I avoid ambiguous characters?

The 'Avoid Ambiguous Characters' option removes characters that look similar in many fonts: 0 (zero) vs O (letter), l (lowercase L) vs 1 (one) vs I (uppercase i), S vs 5, B vs 8. Enable this when you might need to read or dictate the password aloud, copy it by hand, or use it on systems with hard-to-read fonts. The slight reduction in character set has minimal impact on security if you compensate with a slightly longer password.

Sources