Free tool
Generate a password worth using
Built in your browser with the operating system's own randomness. Nothing is sent anywhere, nothing is stored, and you can read the source of the page to check.
Generated with crypto.getRandomValues, the randomness source your browser exposes for cryptographic use. The value never leaves this page.
What the bits number actually means
Entropy measures how many guesses an attacker needs, on average, to find your password. Each extra bit doubles that number. It is the only figure that says something useful — a coloured bar is a design choice, 95 bits is a fact.
The maths is simple: length multiplied by the base-2 logarithm of the alphabet size. Twenty characters drawn from 90 possibilities gives about 130 bits. Ten characters from the same alphabet gives 65 — half, not a bit less.
Which is why length beats cleverness. Adding symbols to a short password buys you a handful of bits; adding six characters buys you forty. Nothing you can remember and reuse comes close, and that is the real argument for a manager.
| Password | Entropy |
|---|---|
| Tr0ub4dor — a word with substitutions | 28 |
| 8 random characters, letters and digits | 47 |
| correct horse battery staple — 4 random words | 95 |
| 20 random characters, full alphabet | 131 |
Figures assume the attacker knows which scheme you used, which is the assumption to make. A substituted dictionary word is guessed by a tool built for exactly that.
Four habits that matter more than the password itself
One password per account
A leak somewhere else is how most accounts fall. Reuse turns one breach into all of them, and no amount of complexity fixes that.
Length before symbols
Sixteen characters of plain letters beats eight with punctuation, by a wide margin. Pick the longest the site accepts.
Let something else remember
Passwords you can remember are passwords someone can guess. A manager removes the trade-off entirely.
Add a second factor
Even a perfect password is one phishing page away from being known. A second factor is what makes that survivable.
One password is easy. Two hundred is the problem.
This page solves a single password. SandPass is the zero-knowledge manager for the rest — generated, stored encrypted on your device, and filled in when you need them. We cannot read them either.
Look at SandPassIncluded in the SandVPN suite. See the plans