Password Generator

What Makes a Strong Password?

A strong password is long, genuinely random, and unique to each account. The Australian Cyber Security Centre (ACSC) recommends using a password manager to maintain distinct credentials across all your accounts — because the alternative, reusing passwords, turns every data breach into a master key for every other service you use.

Australia has experienced a surge in high-profile breaches in recent years. The 2022 Optus breach exposed 9.8 million customer records; the 2022 Medibank breach compromised the health data of 9.7 million Australians. Both incidents resulted in stolen credentials being published on the dark web and subsequently used in downstream attacks. Under the Notifiable Data Breaches (NDB) scheme — part of the Privacy Act 1988 — organisations must notify affected individuals and the OAIC when a breach is likely to result in serious harm.

This generator uses crypto.getRandomValues(), the browser's cryptographically secure random API. Your password is created entirely within your browser and never transmitted anywhere.

How the Password Generator Works

Choose your character types, adjust the length slider to between 8 and 128 characters, and click Generate. The tool builds a character pool from your selections, then picks each character independently using crypto.getRandomValues() with rejection sampling to prevent modulo bias. The result is statistically indistinguishable from drawing from a perfectly shuffled deck of all possible characters.

No data leaves your device. The generator runs entirely in your browser. No password is ever sent to our servers, logged, or stored. You can confirm this by opening DevTools (F12) → Network tab and watching for outbound requests while generating — you will see none triggered by the Generate button.

Understanding Password Entropy

Entropy, measured in bits, tells you how difficult a password is to guess. The formula: entropy = log₂(pool size) × length. A 16-character password drawn from all 95 printable ASCII characters has roughly 105 bits of entropy.

In practical terms: at 1 billion guesses per second — the speed of a consumer GPU running a fast hash algorithm — exhausting a 72-bit keyspace takes over 2 billion years on average. The ACSC recommends passwords of at least 13–15 characters for general use, and longer for high-value accounts. Our strength meter shows you the actual bit count so you can see precisely where your settings land — not just a vague "strong" label.

Password Best Practices for Australian Users

• Unique passwords for myGov, banking, and email above all else. These three account types give attackers the broadest access to your identity and finances. A compromised myGov account can expose tax, Medicare, and Centrelink data simultaneously.
• Enable multi-factor authentication. The ACSC's "Essential Eight" mitigation strategies list MFA as a top-priority control. Most Australian banks, the ATO, and myGov all support it.
• Use a reputable password manager. The ACSC explicitly recommends password managers as the practical solution to the unique-password problem. Bitwarden, 1Password, and Dashlane all offer Australian-accessible plans.
• Check for breach exposure. Visit haveibeenpwned.com — built by Australian security researcher Troy Hunt — to check whether your email has appeared in known data breaches. It is free and used by the ACSC.
• Be alert to post-breach phishing. Following the Optus and Medibank breaches, attackers targeted victims with highly personalised phishing emails using their real data. Treat any unexpected contact as suspect, regardless of how much detail the sender knows.

Password Security in Australia: Regulatory Context

The Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme govern how Australian organisations must handle personal data and respond to breaches. The Office of the Australian Information Commissioner (OAIC) enforces these requirements and publishes quarterly breach statistics — credential compromise consistently ranks among the top breach causes.

The Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate, provides the authoritative guidance framework for both organisations and individuals. Their "Essential Eight" framework and free resources at cyber.gov.au are the starting point for anyone serious about personal or organisational security.

The 2022 Optus and Medibank breaches were watershed moments in Australian public awareness of data security. Both resulted in parliamentary inquiries, proposed Privacy Act reforms, and a significant increase in Australians seeking to understand and improve their own credential hygiene.