Frequently Asked Questions
Answers to common questions about password generation, entropy, and security.
Is this password generator safe to use?▾
Yes. This password generator runs entirely in your browser using the Web Crypto API (crypto.getRandomValues()), which provides cryptographically secure random number generation. Passwords are never sent to any server, stored in any database, or logged anywhere. Unlike password managers that generate passwords server-side or push signup, all processing is 100% client-side.
What makes a strong password?▾
A strong password has high entropy — typically 80+ bits. This is achieved through length (16+ characters), character variety (uppercase, lowercase, numbers, symbols), randomness (no predictable patterns), and uniqueness (never reused across sites). A 20-character random password with all character types has approximately 131 bits of entropy.
What is password entropy?▾
Password entropy measures the randomness and unpredictability of a password in bits. It is calculated as: length × log₂(charset size). For example, a 16-character password using all 95 printable ASCII characters has 16 × log₂(95) ≈ 105 bits of entropy. Higher entropy means exponentially more guesses required to crack it.
How many characters should my password be?▾
For important accounts (email, banking, password manager master), use at least 16 characters with mixed character types, or 20+ for maximum security. For less critical accounts, 12 characters is a reasonable minimum. Passphrases with 5–7 random words are also effective and easier to remember.
What is the difference between a password and a passphrase?▾
A password is typically a shorter string of random characters (e.g., Kx9#mP2$vL), while a passphrase is a longer sequence of random words (e.g., anchor-bright-cedar-delta-ember). Passphrases can achieve similar or higher entropy with fewer characters to remember, making them ideal for master passwords you need to type frequently.
Are generated passwords stored anywhere?▾
No. Generated passwords exist only in your browser session and are destroyed when you refresh or close the page. Nothing is stored on any server, no cookies track your generated passwords, and no analytics capture your password data.
How does the strength checker work?▾
The strength checker uses entropy-first analysis: it calculates the character pool size and password length to estimate base entropy, then applies lighter penalties for known weak patterns — common dictionary words, keyboard sequences (qwerty), repeated characters, short length, and low character diversity. The result is a score with a label (Weak through Excellent) and a crack-time estimate.