Question 1

Should I use a random password or a passphrase?

Accepted Answer

Both are legitimate, and the 2024 NIST digital identity guidelines explicitly favor length over forced complexity rules. A random password packs more entropy per character, which is ideal when a password manager will remember it for you. A passphrase - several random words strung together - trades a bit of entropy per character for something a human can actually memorize and type, which matters for master passwords or anything you type from memory.

Question 2

What does 'bits of entropy' actually mean?

Accepted Answer

Each additional bit of entropy doubles the number of guesses an attacker would need to try every possibility. A password with 40 bits of entropy has about a trillion possible combinations; one with 80 bits has about a trillion times a trillion. Security guidance generally treats 80+ bits as excellent for anything you can't put behind rate-limiting or lockouts, like an encryption key or a password manager's master password.

Question 3

How is the crack-time estimate calculated?

Accepted Answer

It assumes an attacker with offline access to a password hash, guessing at roughly 10 billion attempts per second - a rough stand-in for a modern GPU cluster. It's meant to communicate order of magnitude, not a precise forecast: real crack time depends heavily on the hashing algorithm the target system uses, which this tool has no way of knowing.

Question 4

Why exclude ambiguous characters like l, 1, I, O, and 0?

Accepted Answer

They're easy to mix up when read aloud, handwritten, or displayed in certain fonts. Excluding them trades a small amount of entropy for a password that's less error-prone to type from a screen or a piece of paper - useful for passwords you'll need to enter manually rather than paste from a manager.

Question 5

Could the random generator favor certain characters over others?

Accepted Answer

No - it uses rejection sampling on top of crypto.getRandomValues() rather than a simple modulo operation. Taking a random byte and doing byte % poolSize would give characters near the start of the pool very slightly better odds whenever the pool size doesn't evenly divide 256, so the generator instead discards any out-of-range value and draws again until the result lands in a range that divides evenly. The result is that every character has exactly the same probability of being chosen, no matter how many character types you enable.

Question 6

Why does a random password always include at least one of every character type I enabled?

Accepted Answer

After building the character pool, the generator sets aside one character from each category you've turned on - uppercase, lowercase, numbers, symbols - before filling the rest of the length from the full pool, then shuffles everything into a random order. That guarantees your password won't accidentally end up all letters with no digit, which matters because many sites reject a password missing a required character type even though the pool included one. The shuffle step uses the same unbiased random selection, so the guaranteed characters don't end up in predictable positions.

Tarayıcınız güncel değil

Password Generator

Frequently asked questions