$ password --strong
Strong Password Generator — Random Passwords and Passphrases
Generate random passwords with your browser's cryptography or memorable passphrases — with an entropy meter and estimated time to crack. Nothing leaves your machine.
- 100% in your browser
- free
- no sign-up
How to use the generator's two modes
In the Random password tab, adjust the length on the slider (from 8 to 64 characters, with 16 as the default), tick the classes the account accepts — uppercase, lowercase, numbers and symbols — and set how many passwords you want at once (up to 20). The exclude ambiguous option removes characters that are easy to confuse, like I, l and 1 or O, 0 and o: useful when someone will read or type the password instead of pasting it. Every generated password contains at least one character from each ticked class, and the copy button next to each one takes the value straight to the clipboard.
In the Passphrase tab, you choose from 3 to 8 words drawn from a list of 250 Portuguese terms, the separator (hyphen, dot, underscore or space), whether the words start with a capital letter and whether a number lands in a random position. The result — something like Tigre-Nuvem-42-Prata-Vidro — is a password you can memorize and type without suffering. In both modes, the meter at the top of the result shows the strength of the current configuration in bits of entropy and the average time a brute-force attack would take to crack it.
The math of strength: entropy in bits
A password's strength is not in its looks, but in the size of the search space the attacker must traverse. That space is measured in bits of entropy: a configuration with n bits generates 2n equally likely passwords. The math is direct: entropy = length × log2(pool). With the four classes ticked, the pool has 85 characters (26 lowercase + 26 uppercase + 10 numbers + 23 symbols), that is, about 6.4 bits per character. An 8-character password adds up to ~51 bits — an offline attack at 10 billion guesses per second solves it in a few hours. The same configuration with 16 characters exceeds 100 bits: the same attack would take longer than the age of the universe.
That is why length beats complexity: each extra character multiplies the space by 85, while swapping a letter for a "clever" symbol barely moves the needle — cracking programs try substitutions like @ in place of a before anything else. The tool's meter translates the bits into a practical ruler: below 45 bits, weak; 45 to 59, fair; 60 to 79, strong; and from 80 up, excellent.
Passphrases: memorable and strong
The passphrase applies the same math to bigger units: instead of drawing characters, it draws whole words — the technique popularized by the diceware method. Each word from this 250-word list adds log2(250) ≈ 8 bits, so 4 words add up to ~32 bits, 6 words ~48 and 8 words ~64, before the number and capitalization bonuses. The trick is that, for the brain, Tigre-Nuvem-42-Prata-Vidro is an absurd, easy-to-remember scene, while x7@Qp2#v is noise — but for the computer attacking by brute force, what counts is the total number of bits, not the password's looks.
The list was built with short everyday Portuguese nouns and adjectives, without accents or cedilla, on purpose: passwords get typed everywhere — a laptop keyboard in US layout, a phone screen, a TV, a server terminal — and accents are a source of error and frustration. Prefer passphrases where you type from memory (the manager's master password, computer login, Wi-Fi) and increase the number of words instead of inventing complications: from 6 to 8 words, the strength multiplies by 62,500.
Good practices beyond the password
A strong password is only one part of security hygiene. Use a password manager to generate and store a unique password per service — you only memorize the master password (a good passphrase of 6+ words) and paste the rest. Enable two-factor authentication (2FA) on important accounts, preferably with an authenticator app or hardware key instead of SMS: with 2FA, even a leaked password cannot open the account by itself. And do not rotate passwords by the calendar — change them when there is evidence of a leak, and never reuse the same password on two services.
Finally, remember that the strongest password in the world does not survive phishing: check the site address before typing credentials and be suspicious of links received by e-mail or message. Everything this tool produces is born and dies in your browser — once the password is generated, the only place it should live is your manager.
## faq
Frequently asked questions
What makes a password truly strong?
Length matters more than complexity. Each extra character multiplies the number of possible combinations: an 8-character password with letters, numbers and symbols has about 51 bits of entropy and falls in minutes to an offline attack, while a 16-character one from the same pool exceeds 100 bits — unfeasible to crack by brute force. Swapping a for @ or i for 1 barely helps, because cracking programs try those substitutions first. What brings passwords down in practice is not a missing symbol: it is a short password, a plain dictionary word or a reused password that has already leaked.
Random password or passphrase: which one should I choose?
Use both, for different purposes. The random password (like v9@Kp2#xQ...) is the densest in security per character — perfect for accounts stored in a password manager, where you never type anything from memory. The passphrase (like Tiger-Cloud-42-Silver-Glass) is made to be memorized and typed: ideal for the manager master password, the computer login and the main e-mail. With enough words, the passphrase reaches the same strength as the random one — each word from this 250-word list adds about 8 bits, so 6 to 8 words already reach the strong range.
Is it safe to generate passwords online?
It depends on where the password is generated. Here, everything happens locally in your browser with the Web Crypto API (crypto.getRandomValues), a cryptographically secure generator — the password never leaves your machine, does not pass through a server and is not stored. You can verify: open DevTools (F12), go to the Network tab and click Generate again — no request is fired. Be wary of generators that process on the server or require sign-up: if the password traveled over the network, it stopped being a secret only you hold.
How many characters should I use in 2026?
For ordinary accounts stored in a manager, 16 random characters (about 103 bits) are a comfortable floor and 20 or more cost zero extra effort. For root accounts — main e-mail, password manager, bank — prefer 20+ characters or a passphrase of 6 to 8 words. Current NIST and OWASP guidelines point the same way: prioritize length, accept long passwords (64+), do not require periodic changes without evidence of a leak and do not enforce arbitrary composition rules. If a site limits the size, use the maximum it accepts.
Why should I not reuse passwords?
Because of credential stuffing: when a site leaks, your e-mail and password combination enters public lists, and bots automatically try those combinations on hundreds of other services — bank, e-mail, social networks, stores. In other words, a reused password has the security of the weakest site you ever used it on. A password leaked in some random forum in 2019 can open your e-mail today. With unique passwords per service, a leak stays contained to a single account — and that is exactly what a password manager makes viable.
What is entropy in bits?
It is the measure of how many attempts an attacker would need: n bits of entropy mean 2 to the power of n equally likely combinations. Each extra bit doubles the attacker’s work. On this page, the random password has entropy equal to length × log2(size of the character pool), and the passphrase, words × log2(250). As a practical ruler, the meter classifies: below 45 bits is weak, 45 to 59 fair, 60 to 79 strong and 80 or more excellent — assuming an offline attack at 10 billion guesses per second. Important: entropy comes from the drawing process, not from how the password looks.
## other tools