All passwords are generated entirely on your own device, via the Web Crypto API. There is no server capable of receiving or storing passwords. No storage, no tracking, just safe credentials on demand.
All passwords are generated entirely on your own device, via the Web Crypto API. There is no server capable of receiving or storing passwords. No storage, no tracking, just safe credentials on demand.
Most password generators aim for good enough. This one doesn't.
Following a philosophy of security through over-engineering, this password generator was built to be extraordinarily safe, even in a world of quantum computers. Every password generated is 48 characters long, containing both uppercase and lowercase letters, numbers, and symbols, totaling 9448 possible combinations. That's fifty-one trigintillion, three hundred and two novemvigintillion possible passwords.
These passwords have ~314 bits of entropy, which is considered completely resistant to brute force attacks by any classical computer, now or in the foreseeable future. The time required to crack it would be measure in a number of years that is practically infinite.
The single most important factor in password security is length, as it exponentially increases the number of possible combinations an attacker must test in a brute force attack. Unfortunately, humans are remarkably bad at when it comes to being truly random.
Leading organizations like the National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) recommend a minimum length of 16 characters or more, to remain sufficient against advanced, modern attack vectors. This tool uses 3x that amount, keeping your information secure both today and in the future that awaits us.
Quantum computers can theoretically use a technique known as Grover's Algorithm to accelerate password guessing. Rather than testing combinations one by one, Grover's algorithm can search through possibilities much faster, essentially halving bit security. Even after accounting for that reduction, a password generated by this tool still provides approximately 157 bits of effective security.
For context, 128 bits of security is widely considered the threshold at which brute force attacks become infeasible for any technology allowed by the laws of physics. To crack a 157 bit password, a quantum computer would still need to perform 2157 operations. Even if we turned every atom in the universe into a supercomputer, it would take billions of years to guess it.
This tool was designed to be used in tandem with password managers, and prioritizes maximum security over convenience. As a result, some older or poorly designed services may reject passwords of this length or certain special characters.
Software that cannot accept 48 character passwords is not aligned with modern security best practices, so take that as a sign. The character set used intentionally and forcibly includes characters like colons, a small but deliberate choice that’s known to interfere with some password guessing tools, among other tricks to ensure these passwords are strong.