Question 1

What makes a password truly random?

Accepted Answer

True randomness comes from a source that no one — including you — could predict in advance, even knowing exactly how the generator works. This tool draws every character from crypto.getRandomValues(), a cryptographically secure random number generator built into your browser and backed by your operating system's entropy pool. That's a fundamentally different class of randomness than Math.random() or anything based on the clock, mouse movement timing, or a seeded pseudo-random algorithm, all of which can be predictable or biased enough for an attacker to exploit given enough samples.

Question 2

Are passphrases more secure than random passwords?

Accepted Answer

It depends entirely on length. A passphrase built from several random dictionary words is easier to remember and type, and can reach very high entropy simply by adding more words — each extra word from a 150-word list adds roughly 7.2 bits. A random character password packs more entropy per character (about 6.5 bits per character with a full symbol set), so it reaches the same security level in fewer characters. In practice, a 5-6 word random passphrase and a 14-16 character random password land in a similar strength range — pick whichever you'll actually type correctly and remember without writing down.

Question 3

What is password entropy, and why does it matter?

Accepted Answer

Entropy measures how many guesses an attacker would need, on average, to find your exact password by brute force, expressed as a power of two. It's calculated as E = L × log₂(N), where L is the password's length and N is the size of the character pool it draws from. Every additional bit of entropy doubles the number of guesses required, so entropy — not password length alone, and not how 'complicated' a password looks to a human — is the real measure of how resistant a password is to automated cracking.

Question 4

Should I store passwords in a browser?

Accepted Answer

A browser's built-in password manager is far better than reusing passwords or writing them on a sticky note, and modern browsers do encrypt saved passwords at rest. That said, a dedicated password manager typically adds stronger protections — a separate master password, zero-knowledge encryption, breach monitoring, and secure sharing — and isn't tied to a single browser or synced account. For anything sensitive, a dedicated manager is the safer long-term home; for everyday low-risk logins, your browser's manager is a reasonable and convenient choice.

Password
Generator

Password Settings

How to Create a Strong Password

Password Strength Guidelines

Frequently Asked Questions

Related Calculators

PasswordGenerator