Password generator

Generated in your browser, from the operating system's cryptographic randomness, and never sent anywhere. The strength is worked out rather than colour-coded: you get the number of bits and where they came from.

Length beats punctuation, and it is not close

Twenty lower-case letters give 94 bits. Twelve characters drawn from the full punctuated alphabet give 77.9. The longer, simpler one is about seventy thousand times harder to guess, and it is very much easier to type on a phone.

The arithmetic is length × log₂(alphabet). Adding punctuation takes the alphabet from 62 to 90, which buys you 0.54 bits a character. Adding one more character buys you 5.95. That is the whole argument, and it is eleven times over.

The punctuated set here is 90 rather than the 95 printable keys, because the quote, the double quote, the backslash, the backtick and the space are left out on purpose. They are the characters that break shell commands, spreadsheets and copy-and-paste, and the half a bit each one would have added is not worth a password that will not paste.

Why there are three crack times and not one

A single “time to crack” is a guess dressed as a fact, because it depends entirely on an assumed guessing speed that the page usually does not tell you. The same 62-bit password takes about seven million years at ten thousand guesses a second and under a month at a trillion — a difference of a hundred million times, from an assumption nobody showed you.

So all three are given, each labelled with the assumption behind it. The number that matters is the bits; the years are that number made imaginable.

Where the randomness comes from

From crypto.getRandomValues(), which browsers back with the operating system's cryptographic random source. Not Math.random(), which is fast, predictable from its own output, and has no business anywhere near a password.

The selection also rejects the uneven tail of the random range rather than taking a remainder, which would make the first few characters of the alphabet very slightly more likely than the rest. That bias is small and there is no reason to accept it.

Where to go next

Two more that make something rather than work something out:

• username generator — the other half of signing up for something
• random number generator — the same randomness, shown rather than hidden

What this does not do

Nothing leaves your browser. There is no server here to send it to, nothing is stored, and the page does not remember what it generated a moment ago. Close the tab and it is gone — which also means you must copy it somewhere before you do.

It does not generate passphrases, because that needs a word list and the list is the thing that has to be published and trusted. As arithmetic: four words drawn at random from a list of 7,776 gives 51.7 bits, which is about the same as eight random printable characters and enormously easier to remember.

And it cannot tell you whether a password is safe. Bits measure guessing. They say nothing about a password you have reused, one that was in a breach, or one you tell somebody over the phone.