Password Generator

Instead of calling a password "weak" or "strong," this page shows its entropy in bits and two cracking times under named assumptions: after a database leak, when an attacker runs guesses on a graphics card at ten billion per second, and through a login form, where more than a thousand attempts per second will not happen.

Every password contains at least one character from each selected set, because a registration form would otherwise send it back for a redo: a random sixteen-character password has roughly a one in seven chance of coming out with no digit at all.

This requirement shrinks the space of possible passwords, and the calculation accounts for it: strength is measured over the space of passwords that meet it, not over raw length and alphabet size.

Nothing is stored

Passwords leave no history. A copied password stays in your clipboard until the next copy overwrites it.