Password generator

entropy = length × log2(alphabet)

Password strength is measured in bits of entropy — how many attempts are needed. 60 bits — minimum for important services, 80+ for banks and email, 100+ for a password-manager master. Our indicator is the raw formula and doesn't account for dictionary attacks on weak patterns.

4 words × log2(500) ≈ 36 bits · 6 words — 54

Three or four random words from a large list are easier to memorise than 16 random characters, with comparable entropy. Diceware is the classic method: 7776 words × 5 dice rolls. Our list is ~500 words — use 5–6 words for enough entropy.

exclude — fewer typos, lower entropy

0 and O, 1/l/I, S/5 — easy to confuse on paper and in a monospace font. Excluding them helps with hand-typed passwords. The downside — slightly lower entropy (smaller alphabet). Not critical if length ≥ 14.

no notepad · no browser · no email

A unique complex password per service is the only real defence against mass leaks. You can't remember them all. Use a password manager (1Password, Bitwarden, KeePass) with a single 20+ character master password or a 6-word passphrase.