© 2026 José Carrillo
Advanced password generator
Generate cryptographically secure keys and analyze the strength of any password. Everything happens in your browser.
Key type
Removes 0 O 1 l I — useful when the key is dictated or hand-copied
Every key will include at least one lowercase, uppercase, digit and symbol available in the alphabet
Never the same character twice in a row
Group with dashes
Inserts a dash every N characters for readability (does not affect entropy)
Analysis of this configuration
What an attacker would face with each key generated with these settings:
Estimated alphabetHow many distinct symbols can appear in the key. The bigger the alphabet, the harder each position is to guess.
189 symbols
Maximum entropyMeasures how unpredictable the key is. Each bit doubles the combinations: 10 bits is 1,024; 40 bits, over a trillion.
~483 bits
Crack time by attack scenarioAverage time to find the key by trying half of the combinations. Web login: a server that throttles attempts. Cluster: cloud attacking a slow KDF like PBKDF2. GPU farm: dedicated hardware against a fast hash. Nation-state: the largest known capacity.
Throttled login
10² guesses/s
≈10¹³⁵ years
Cloud cluster
10⁶ guesses/s
≈10¹³¹ years
GPU farm
10¹² guesses/s
≈10¹²⁵ years
Nation-state
10¹⁵ guesses/s
≈10¹²² years
Cybersecurity framework
Compliance against industry guidance and thresholds:
- NIST SP 800-63B — minimum length (≥8) The U.S. government standard for digital identity requires passwords of at least 8 characters.Pass
- OWASP baseline (≥64 bits) Recommended minimum to resist modern automated attacks with commodity hardware.Pass
- Long-term protection (≥100 bits) Threshold for the key to remain secure for decades, even as attacker hardware improves.Pass
- AES-128 equivalent (≥128 bits) Same strength as an AES-128 key, the standard cipher used by banks and governments.Pass
- Post-quantum — Grover (≥128 bits after halving) A quantum computer (Grover's algorithm) halves the difficulty in bits. If ≥128 bits still remain, even a quantum computer could not brute-force it.Pass
Total combinationsTotal number of possible keys with this configuration. An attacker would need to try half of them on average.
≈10¹⁴⁵
Post-quantum entropySecurity bits that would remain against a quantum computer: half of the classical ones.
241 bits
Versus an average human passwordComparison with a typical human-chosen password: 8–10 predictable characters, about 40 bits of real entropy.
≈10¹³³ times more combinations
Configure and press “Generate keys”
Generation uses crypto.getRandomValues (no modulo bias) and analysis is 100% local. No key ever leaves your device.