Entropy Is the Only Number That Matters

A password's real strength is measured in bits of entropy: how many guesses an attacker needs on average before finding it. Entropy is roughly calculated as length multiplied by log2 of the character set size. That formula explains two things people often get backwards:

• A 24-character lowercase-only password can be stronger than a 10-character password stuffed with symbols.
• Adding symbols helps, but adding length helps more, because entropy grows linearly with length and only logarithmically with character-set size.

Rules of Thumb

• Under 60 bits: crackable with consumer hardware in a realistic timeframe. Avoid for anything important.
• 60 to 90 bits: strong enough for most personal accounts.
• 90+ bits: appropriate for master passwords, API secrets, and anything protecting other secrets.

What a Good Generator Should Do

• Draw from a cryptographically secure random source (such as crypto.getRandomValues, not Math.random), so the output can't be predicted from timing or seed.
• Let you toggle character classes (uppercase, lowercase, digits, symbols) independently, since some legacy systems still reject certain symbols.
• Report the actual entropy in bits, not just a vague strong-or-weak label.

A Sane Password Policy

1. Use a password manager and let it generate a unique, high-entropy string per site. You should never need to remember most of your passwords.
2. Reserve a memorable passphrase only for your password manager's master password, and make it long rather than clever.
3. Never reuse a password across services. A breach on one unrelated site should never threaten another account.

The Password & Secret Key Generator generates high-entropy strings locally in your browser using a secure random source, and reports the resulting entropy in bits so you know exactly how strong the output is.