Password generator

Length beats complexity, and it is not close

Every character you add multiplies the number of possible passwords; every rule you add merely changes which characters are in play. That is why a twenty-character lowercase password is dramatically stronger than an eight-character one with a symbol and a capital, despite looking far less "secure".

Notice the first two rows. Adding every symbol on the keyboard to an eight-character password buys three bits. Adding four characters buys twenty-three.

Why the strength bar here shows a number

Most strength meters score how a password looks — did you use a capital, is there a digit, does it contain a dictionary word. Those heuristics exist because the site cannot know how the password was made, and they are wrong in both directions: P@ssw0rd1 scores well and is on every cracking list, while a random string can score badly for having no capital.

For a password drawn uniformly at random, none of that applies. The only thing that matters is how many equally likely values there were, which is exactly what entropy measures. So the figure here is length × log₂(alphabet) and nothing else.

The randomness matters as much as the length

A password is only unguessable if the process that made it is. The everyday random number generator in JavaScript is fast, predictable in principle, and its future output can be reconstructed from a short run of past values — fine for shuffling a carousel, useless for a secret.

This uses the browser's cryptographic generator instead, and it draws each character by rejection sampling rather than by taking a remainder. The shortcut everyone reaches for makes the first few characters of the alphabet slightly more likely than the rest; small, but a bias in a password generator is worth not having.

What to do with it

Put it in a password manager. The reason generated passwords are worth using is that they are impossible to remember, and the reason that is acceptable is that you should not be remembering them. One generated password per site, stored in a manager, behind one long passphrase you do remember.

Reuse is the failure that actually hurts people. A password used in two places is only as safe as the more careless of the two, and you will not find out which that was until afterwards.

Questions

Is it safe to generate a password on a website?

It depends entirely on where the password is generated. If a site builds it on its server, that server has seen your password and you have no way to know what it did with it. This page generates it in your browser using the built-in cryptographic random number generator — nothing is sent anywhere, and you can confirm that with the Network tab open and watch nothing leave.

How long should a password be?

Length matters far more than complexity. Sixteen random characters is comfortably beyond brute force; twenty is beyond argument. Adding a symbol to a short password helps much less than adding four more characters, because every extra character multiplies the search space rather than adding to it.

What does "bits of entropy" mean?

It is the number of times you would have to double the guessing effort to cover every possible password — so 60 bits means about a billion billion possibilities. It is the only honest measure for a randomly generated password, and it is why this page shows a number rather than a word like "strong". Below 40 bits is weak, 60 to 80 is solid, and beyond 80 no offline attack is practical.

Should I use symbols?

They help, but less than people think. Going from letters and digits to letters, digits and symbols raises the per-character entropy from about 6 to about 6.5 bits — roughly the same gain as making the password one character longer. Use them where a site demands them, and lengthen rather than complicate where it does not.

What is the "avoid ambiguous characters" option for?

Passwords that will be read off a screen and typed by hand, or dictated. It removes the pairs people confuse — l against I against 1, and O against 0 — at a small cost in entropy, which the bit count reflects immediately.

Should I reuse a strong password?

No. A password reused across sites is only as safe as the least careful site holding it, and breaches are routine. Use a password manager and a different generated password everywhere. A very strong password used in two places is a weaker arrangement than two ordinary ones.

Do you log or store what is generated?

There is nowhere to log it to. The generator is JavaScript running in this tab; no request is made when you press the button, and the page works with no network connection at all. That is checkable rather than promised.

What BriskFile will not do to you

• Your files never leave your device

  Every conversion runs in your browser. Open DevTools, watch the Network tab, and you will see no upload — because there is not one.

• No account, no email, no watermark

  Nothing to sign up for and nothing stamped on your images. There is no step between choosing a file and getting it back.

• No limits at the download button

  No daily cap, no file counter, no "upgrade to download". If the tool starts a job, it finishes it.

• Checkable, not just claimed

  Open the Network tab and convert something — nothing goes out. Or load the page, disconnect, and watch it keep working: the tool is already on your machine, and your file never leaves it.