Password Generator

What Makes a Strong Password?

A strong password is your first line of defence against unauthorised access to your accounts. The National Cyber Security Centre (NCSC) defines a strong password as one that is long, random, and unique — used nowhere else. Length matters more than complexity: a 16-character password using only lowercase letters has more combinations than an 8-character password using every character type available.

Under UK GDPR, organisations are legally required to protect personal data using appropriate technical measures — and weak credential policies have resulted in enforcement action by the ICO. For individuals, the stakes are equally high: credential stuffing attacks, where leaked passwords from one breach are tested against other services, affected millions of UK users following the 2021 LinkedIn and RockYou2021 data exposures.

This generator creates passwords using cryptographically secure randomness via the crypto.getRandomValues() browser API — the same standard used in security software. Your password is generated entirely within your browser and never sent to any server.

How the Password Generator Works

Every password is built from a character pool assembled according to your settings. Toggle uppercase, lowercase, numbers, and symbols on or off; exclude visually similar characters like 0 and O or shell-unsafe characters like curly braces; switch to pronounceable mode for a memorable-but-strong result. The generator then draws from that pool using crypto.getRandomValues() — a cryptographically secure source of randomness built into every modern browser.

Nothing is transmitted. There are no API calls, no analytics payloads containing your password, no server logs. The page works entirely offline once loaded. You can verify this yourself by opening your browser's network inspector before generating — you will see zero outbound requests triggered by the Generate button.

Bulk generation lets you produce up to 50 passwords at once — useful for provisioning multiple accounts, creating temporary credentials, or running a personal password audit across your services.

What Is Password Entropy and Why Does It Matter?

Entropy is the measure of unpredictability in your password, expressed in bits. The formula is straightforward: entropy = log₂(pool size) × length. A password drawn from a pool of 95 printable ASCII characters at 16 characters long has approximately 105 bits of entropy.

To put that in concrete terms: at 1 billion guesses per second — the speed of a modern GPU cluster — a 72-bit password takes on average 2.4 billion years to brute-force. A 40-bit password takes under two weeks. The difference between "Fair" and "Strong" on our meter is not cosmetic — it is the difference between a password that falls to an affordable cloud attack and one that is computationally infeasible to crack in any realistic timeframe.

Most password strength meters show you a coloured bar and a vague label. We show you the actual bit count so you can make an informed decision. The NCSC recommends passwords of at least 12 characters; security researchers generally regard 80+ bits of entropy as safe against foreseeable brute-force attacks.

Password Best Practices for UK Users

• Use a unique password for every account. Reuse is the primary vector for credential stuffing. When TalkTalk was breached in 2015 and exposed 157,000 customer records, users who reused those credentials elsewhere suffered cascading account takeovers.
• Enable two-factor authentication (2FA) wherever available. HMRC, your bank, and most major UK services now offer 2FA. A strong password plus 2FA makes unauthorised access extremely difficult even if your credentials are somehow obtained.
• Use a password manager. The NCSC explicitly recommends password managers as a practical solution for maintaining unique passwords across many accounts. Your generated password can be saved directly to your manager — no memorisation required.
• Check Have I Been Pwned. Troy Hunt's service (haveibeenpwned.com) lets you check whether your email address has appeared in known data breaches. It is free, trusted by the NCSC, and used by major UK organisations.
• Never share passwords via email or SMS. If a service asks you to confirm your password by email, that is a red flag — legitimate services never need your plaintext password.

Password Security in the UK: Regulatory Context

The UK GDPR (retained from EU GDPR post-Brexit and supplemented by the Data Protection Act 2018) places a legal duty on organisations to implement appropriate technical and organisational measures to protect personal data. The Information Commissioner's Office (ICO) has issued fines for breaches attributable to weak password policies and inadequate access controls.

The National Cyber Security Centre (NCSC), part of GCHQ, publishes freely available guidance for both organisations and individuals. Their "Three Random Words" approach for memorable passwords, and their explicit endorsement of password managers, reflect a pragmatic shift away from complex-but-short passwords toward long-but-memorable ones.

Notable UK breaches that began with compromised credentials include the 2015 TalkTalk breach (157,000 records), the 2017 WannaCry attack on the NHS (which exploited weak system credentials), and the 2023 Royal Mail ransomware incident. Each underscores that credential hygiene is not merely a personal concern — it is a systemic infrastructure issue.