Password and passphrase generator
A password, passphrase, PIN or your own pattern — from the browser's cryptographic generator, with entropy and crack times for four attack scenarios. The second tab checks your own password: common passwords, dictionary words with substitutions, keyboard walks, dates and Russian words typed in the English layout.
Free, no sign-up
Loading word lists…
Computed from the generation model: log₂ of the number of equally likely outcomes with these settings.
Added to the selected sets (for example, Cyrillic or €).
Best effort: the browser may refuse to read or clear the clipboard when the tab is not focused.
| Scenario | Time |
|---|---|
| Online, rate-limited100 guesses per hour: a site login with lockout | ≈ 7.4·10³¹ years |
| Online, no rate limit10 guesses per second | ≈ 2.0·10²⁹ years |
| Leaked database, slow hashbcrypt / scrypt / Argon2: 10,000 guesses per second | ≈ 2.0·10²⁶ years |
| Leaked database, fast hashMD5 / SHA-1 / SHA-256 on GPUs: 10 billion guesses per second | ≈ 2.0·10²⁰ years |
How the generator works
Randomness
Only crypto.getRandomValues — the browser's cryptographic generator. Picking one of N options uses rejection sampling: 32-bit values in the 2^32 mod N tail are discarded, so characters are equally likely (no modulo bias).
Password
Length 8–128, sets: lowercase, uppercase, digits, symbols (!@#$%^&*()-_=+[]{};:,.?/~) and your own characters. “No look-alikes” removes I l 1 | O 0 o. “One from each set” is enforced by rejecting whole passwords: valid passwords stay equally likely, and the entropy is exact — by inclusion–exclusion.
Passphrase
Words from the EFF Large Wordlist (7776 words — 12.9 bits per word) or our Russian list in Cyrillic or Latin letters. Case, a digit separator and a number add entropy, and it is counted: random case is +1 bit per word, a digit separator +3.3 bits.
PIN
“Exclude weak” drops repeated digits, ascending and descending runs and, for 4 digits, the years 1900–2099 and the 20 most common PINs (1234, 1111, 0000, 1212, 7777, 1004…). Entropy is log₂ of the remaining options.
Pattern
Your own format such as “W-W-W-dd-s”: W — Capitalised word; w — lowercase word; d — digit; s — symbol; l — lowercase letter; u — uppercase letter; a — letter or digit.
very weak
- Entropy
- 0–27 bits
weak
- Entropy
- 28–35 bits
fair
- Entropy
- 36–59 bits
strong
- Entropy
- 60–79 bits
very strong
- Entropy
- 80+ bits
Online, rate-limited
- Guess rate
- 100 guesses per hour: a site login with lockout
Online, no rate limit
- Guess rate
- 10 guesses per second
Leaked database, slow hash
- Guess rate
- bcrypt / scrypt / Argon2: 10,000 guesses per second
Leaked database, fast hash
- Guess rate
- MD5 / SHA-1 / SHA-256 on GPUs: 10 billion guesses per second
Crack time for a generated password is the average: half of the space divided by the rate. Real speed depends on the attacker's hardware and the server's hashing settings.
How your password is checked
The estimate is a simplified zxcvbn model (Dropbox; Wheeler, USENIX Security 2016): the password is split into fragments, each with a guess estimate, and dynamic programming picks the split that is cheapest for an attacker. Entropy here is log₂ of the guess estimate, not “length × character set”.
- Common passwords: the 5000 most common from SecLists (MIT licence) — the rank is the number of guesses.
- Dictionary words: the EFF Large Wordlist (English), our Russian list and common Russian-speaker passwords, plus transliteration, reversal and letter-to-digit/symbol swaps (p@ssw0rd).
- Wrong keyboard layout: “gfhjkm” is the Russian word for “password” typed on the English layout; “дщму” is “love” typed on the Russian one.
- Keyboard walks (QWERTY and JCUKEN), repeats (aaaa, abcabc), sequences (abcd, 4321), years and dates in several formats.
- The first 64 characters are analysed; the rest counts as brute force by character class.
Limitations
- The generator's entropy holds only if you do not edit the result: a hand-tweaked password is no longer random.
- The check of your own password is a lower bound for known patterns: an attacker who knows more about you (names, dates, old passwords) will be faster.
- Clipboard clearing is best effort: the browser may block reading or writing the clipboard when the tab is not focused, and system clipboard managers may keep history.
- A site may limit password length or characters — check its requirements.
Privacy and sources
- Passwords are generated and checked only in your browser: they are not sent to a server, not put into the page URL and not stored — only settings (mode, length, sets) stay in localStorage.
- Analytics receives only the fact of generating, copying or checking and a category (mode, strength level) — never the passwords.
- The result reaches us only if you send a request yourself and keep the “Attach the result” box ticked — the form shows exactly what will be sent. Keys, passwords and tokens are never part of the summary.
- EFF Large Wordlist for Passphrases — © Electronic Frontier Foundation, CC BY 3.0 US licence (eff.org/dice); included unchanged.
- Common passwords — SecLists, Passwords/Common-Credentials/10k-most-common.txt (first 5000), © Daniel Miessler, MIT licence.
- The Russian word list and common Russian-speaker passwords were compiled by InterLAB.
Related tools
All tools · 40
WireGuard config generatorA website cannot be a VPN — but here you build a real WireGuard setup for your server: X25519 keys, wg0.conf with NAT, a .conf and QR code per phone and laptop, subnet and route checks, a ZIP and setup steps. Keys never leave your browser.
SSH key generatorEd25519 and ECDSA P-256 in OpenSSH format with a passphrase (like ssh-keygen), SHA256/MD5 fingerprints and randomart, restricted authorized_keys, ~/.ssh/config and an inspector for any public key. Keys are generated on your device.
JWT decoder, verifier and builderDecode a token part by part, verify HS/RS/PS/ES/EdDSA signatures with a PEM, JWK or JWKS key, see expiry with a countdown, 16 security rules, and build test tokens.
CIDR subnet calculatorIPv4 and IPv6: mask, range and exact address count, a binary view with the network boundary, subnetting and VLSM, list merging, overlaps with an address map, reverse DNS zones.
Image compressor (WebP/AVIF)Drop images in — WebP, AVIF or JPEG by quality or a target size in KB, a 1:1 before/after slider, srcset and <picture>, batch ZIP. All in the browser.
Favicon and app icon generatorFrom an image, SVG or a letter → favicon.ico, favicon.svg with dark mode, PNGs in every size, apple-touch-icon, maskable, manifest and HTML; tab, iOS and Android previews — in one archive.Want to check how your product stores passwords and secrets?
An audit: password hashing, session and token policy, secrets in code and environment, access — with a risk map and a fix plan. The first short call is free.
- The first short conversation is free — we choose the format
- NDA — yours or ours
- Pricing after a brief and an agreed scope