Password strength comes from two factors: length and character set size. An attacker brute-forcing 10 billion guesses per second would need an astronomically long time to crack a random 20-character password with mixed characters — compared to milliseconds for a short dictionary word.
| Use case | Recommended length | Notes |
|---|---|---|
| General account (email, social) | 16+ characters | Use a password manager — you don't need to remember it |
| Master password / password manager | 20–30 characters | Must be memorable — consider a passphrase of 5+ random words |
| API key / service secret | 32+ characters | Never exposed to humans — maximize entropy |
| Wi-Fi network password | 12–20 characters | Typed manually — balance security with usability |
| Temporary / one-time password | 8–12 characters | Short-lived — lower length acceptable |
Passwords are generated using crypto.getRandomValues() — the browser's cryptographically secure random number generator. This is the same API used by cryptographic libraries. Unlike Math.random(), it is unpredictable and seeded by the operating system's entropy source.
Nothing is sent to a server. Generation happens entirely in your browser tab.
© 2026, Tinker - tools · calculators · practice games