Password Generator

For this one, yes: the page makes no network request while generating. Every password is produced by your browser's own crypto.getRandomValues(), stays in the page, and disappears when you close the tab. Nothing is sent to a server, logged, or saved to your device. You can confirm it yourself by opening your browser's Network tab and clicking Regenerate — nothing will appear. If you would rather not trust any website, a password manager's built-in generator does the same job offline.

Entropy measures how many equally likely passwords the generator could have produced, expressed in bits. Each bit doubles the number of possibilities, so 60 bits means about 2^60 (roughly a billion billion) candidates. It is calculated as length multiplied by log2 of the character-set size, which only holds because every character is drawn uniformly at random — an entropy number quoted for a human-chosen password like "Summer2024!" is meaningless, because people do not pick uniformly.

For anything you store in a password manager, 20 characters with all four character types gives about 130 bits — far beyond any feasible attack, and length costs you nothing when software types it. For a password you have to memorise, such as your password manager's own master password, aim for at least 16 random characters or a passphrase of five or six random words. Below about 12 characters you are inside the range modern GPU cracking rigs handle, so treat those as disposable.

It assumes an attacker who has stolen a password hash and can try ten billion guesses per second offline — a reasonable figure for a fast hash like MD5 or unsalted SHA-1 on consumer GPUs. Real numbers vary enormously: a properly configured bcrypt or Argon2 hash slows that to thousands of guesses per second, making even a weak password survive far longer, while a well-funded attacker with custom hardware can go faster. A live website that locks accounts after a few failures is slower still. Read the label as an order of magnitude, not a deadline.