Generate a random password or an easy-to-type passphrase, and see how many bits of entropy it has and how long it would take to crack.
| Online attack on a login page10 guesses a second, a generous rate for a site that limits login attempts | about 10^22 years |
| Offline, slow hash (bcrypt)100,000 guesses a second against a stolen database stored with bcrypt | about 10^18 years |
| Offline, fast hash (MD5, SHA-1)A trillion guesses a second, roughly a multi-GPU cracking rig against an unsalted fast hash | 246 billion years |
Average time to guess it, assuming the attacker knows exactly how it was generated.
Runs entirely in your browser. Nothing you type or upload is sent to a server.
What actually makes a password strong
A password is strong when an attacker who knows exactly how it was made still cannot guess it in a useful amount of time. That rules out anything a person chooses. People pick words, names and dates, then satisfy complexity rules in predictable ways, like a capital at the start and 1! at the end, and cracking tools try those patterns first. A generated password has no pattern to exploit, so the only attack left is trying every possibility.
How many possibilities there are is called entropy, measured in bits. Each bit doubles the work. A random password's entropy is its length times the bits each character contributes:
| Characters drawn from | Set size | Bits per character | 16 characters |
|---|---|---|---|
| Digits only (a PIN) | 10 | 3.3 | 53 bits |
| Lowercase letters | 26 | 4.7 | 75 bits |
| Upper and lowercase, digits | 62 | 6.0 | 95 bits |
| All of the above plus symbols | 89 | 6.5 | 104 bits |
| One word from the EFF list | 7,776 | 12.9 | n/a |
Notice how quickly length pays off: every extra character multiplies the work again. A 20-character lowercase password beats a 14-character one using every symbol on the keyboard. This is why NIST's digital identity guidelines (SP 800-63B) tell websites to stop forcing composition rules and periodic password changes, and to allow long passwords instead.
Passphrases
A passphrase strings together words picked at random from a list, like Stalling-Hydrated-Grievance-Untidy-Contend-Among. This generator uses the Electronic Frontier Foundation's long word list: 7,776 words, chosen to be easy to spell, distinct from one another and free of offensive terms. 7,776 is six to the fifth power, so the list also works with five ordinary dice, a method called Diceware.
The randomness is what matters. Six random words give about 77.5 bits, as strong as a 12-character password using every symbol, yet they are far easier to type on a phone and to remember. A phrase you make up yourself, such as a song lyric, is not a passphrase in this sense: attackers have lists of those too.
How passwords really get cracked
Nobody guesses passwords by typing them into a login page for long. Sites limit failed attempts, which is why the online estimate is so slow. The real threat is a breach: attackers steal a database of password hashes and test guesses offline on their own hardware, as fast as it will go.
How fast depends on how the site stored the passwords. A deliberately slow algorithm like bcrypt, scrypt or Argon2 holds an attacker to thousands of guesses per second per graphics card. A fast hash like unsalted MD5 or SHA-1 allows tens of billions per card. The estimates under the generator show all three cases, because you cannot know how every site you use stores your password. Aim for a password that survives the worst one: 80 bits or more for anything that matters.
The habits that matter more than strength
- Never reuse a password. Attackers take credentials from one breach and try them everywhere else, a technique called credential stuffing. A unique password per site contains the damage of any breach to one account.
- Use a password manager so unique random passwords cost you nothing to remember. The one password you do memorize, for the manager itself, is the ideal place for a six-word passphrase.
- Turn on two-factor authentication for email, banking and the password manager. Email matters most, because it can reset everything else.
- Check every download you install from outside an app store. The Checksum Calculator compares a file against the hash its publisher lists.
There is a deeper look at these numbers in How long would it take to crack your password?
Passphrase word list: EFF Large Wordlist for Passphrases, Electronic Frontier Foundation, licensed under CC BY 3.0 US.
