Advanced options
Please select at least one character set.
Generated with the Web Crypto API, entirely on your device - your password is never sent to any server.
Time to Crack: Example Passwords
| Password | Time to crack | Why |
|---|---|---|
| 12345 | 0.0005 seconds | Purely numeric and one of the most-leaked passwords on the planet, found in essentially every cracking wordlist before brute force is ever needed. |
| qwerty | 0.0005 seconds | A classic keyboard-walk pattern, consistently ranked among the most common passwords in every major leak. |
| passwordsupersecret | 0.01 seconds | Long, but just three common dictionary words joined with no numbers, symbols, or randomness. Combinator attacks that chain common words together still find this almost immediately, just a touch slower than a single dictionary word. |
| Random, 8 characters | ~19 days | Mixing upper, lower, numbers, and symbols meets the bare minimum length NIST allows, but modern offline hardware can still work through it in a matter of weeks. |
| Random, 12 characters | ~3 million years | This is the length ToolsByTek recommends as a sensible everyday minimum, comfortably out of brute-force range. |
| Random, 16 characters | ~171 trillion years | NIST's suggested length for higher-value or privileged accounts, already far beyond any realistic brute-force attempt. |
| Random, 20 characters | ~9.8 sextillion years | Longer than the universe has existed many times over, available near the top of this generator's length slider. |
The three common passwords above are cracked at wordlist lookup speed, no brute force needed. The random examples assume an offline attacker guessing 1 billion combinations per second across this generator's full 87-character pool, finding the password halfway through the keyspace on average, a commonly used estimate for a well-resourced offline attack. Actual times vary with the attack method and how the password is stored.
Is "123456" a secure password?
No, quite the opposite: "123456" is consistently the single most-used password in the world, found roughly 7.6 million times among over 2 billion leaked passwords analyzed in 2025. It's one of the very first guesses in any automated attack, so it offers essentially no protection at all.
Why should my password contain special characters?
Length actually matters more than symbols - current NIST guidance has dropped mandatory character-mix rules because they just push people toward predictable patterns like "Password123!". That said, mixing in numbers and symbols still meaningfully widens the pool of characters an attacker has to guess from, so a long password that also uses a few special characters remains stronger than one of the same length using only lowercase letters.
How long should a password be today?
NIST's current baseline minimum is 8 characters, but its guidance for higher-value or privileged accounts calls for at least 15. In practice, aim for at least 12-16 characters for everyday accounts, and use the full length this generator allows, up to 64 characters, for anything important.
Where can I safely store passwords?
In a dedicated password manager with strong, zero-knowledge encryption, protected by one strong master password and, ideally, two-factor authentication. Avoid plain text files, spreadsheets, sticky notes, or reusing the same password anywhere else, since a single leaked, reused password puts every account that shares it at risk.