Which password should I choose?
- A random password of 16 characters or more: ideal with a password manager.
- A passphrase of 5 or 6 random words: just as strong, much easier to remember and type, perfect for a password manager's master password.
- A different password for every site, and two-factor authentication when offered.
How is strength measured?
By entropy, in bits: the number of possibilities an attacker would have to try. Each bit doubles that number. Above 80 bits, a password withstands known attacks. The checker also spots common weaknesses: dictionary words, years, sequences (1234, qwerty), repeats.
Are my passwords safe?
They are created by your browser (crypto.getRandomValues) and never leave your device; they are not saved. Only your settings are kept. Passphrase word lists are derived from wordfreq (CC BY-SA 4.0 licence).
How to use it
- Choose the type: password (random characters), passphrase (random English or French words) or PIN.
- Set length and characters: capitals, digits, symbols, and excluding look-alike characters (0/O, l/1/I) for a password you will type by hand.
- Read the meter: it shows entropy in bits and how long it would take to find the password online (protected site, about a hundred guesses per second) and offline (stolen database, ten billion guesses per second).
- Copy the result, or generate several at once.
- Test an existing password in the analyser: it spots common passwords, dictionary words, sequences (abcd, 1234), years and keyboard patterns.
- For a class or a team: paste a list of names to create usernames (first.last, f.last…) and passwords, printed on cut-out slips or exported as CSV.
How many bits do you need?
- 4-digit PIN: 10,000 possibilities. Good enough only because the card locks after three tries.
- 5-word passphrase from a 4,096-word list: 60 bits. Offline, it would take on average almost two years to find. 6 words: 72 bits, thousands of years.
- 16 characters from the 94 printable characters: about 105 bits, out of reach of any brute-force attack.
For important accounts (email, bank, password manager), aim for at least 70 bits. A 6-word passphrase is as strong as an 11-character random password, and far easier to remember.
Good practice
- A different password for every site: the most important rule. A breach on one site must not open your other accounts.
- Use a password manager (Bitwarden, KeePassXC, your browser's…): you then only need to remember one master passphrase.
- Turn on two-factor authentication wherever possible, preferably with an app or security key rather than SMS.
- Don't change a strong, unique password for no reason; do change it immediately after a breach.
How the tool keeps you safe
Draws use the browser's cryptographic generator (crypto.getRandomValues) with unbiased sampling. Nothing is sent or stored: only your settings (length, options) are remembered on the device. Word lists come from the wordfreq frequency data (CC BY-SA 4.0 licence), filtered to keep common, easy-to-type words.
Guide written and checked by Erwan Hautot · updated 5 November 2026.