A password, for everything you never type
If a password manager fills it for you, length costs nothing. The default is 20 random characters from a 87-character alphabet — 128.9 bits, far past the point where guessing is possible.
Password generator
A strong password, made in your browser.
This is the generator inside the Mabits vault, running here on its own. The password is made on your device and never sent anywhere — not to us, not to anybody — and the strength it shows is exact, not a guess.
Copying it clears your clipboard again after 30 seconds, as long as this page stays open.
Generator
Very strong · 129 bits of entropy
How strong is strong enough?
Strength is measured in bits: every extra bit doubles the number of guesses an attacker has to make. The generator can say exactly how many bits a password has, because it knows the alphabet it drew from and every draw was uniform. The same number would be meaningless for a password a person chose, which is why nothing honest can score one that way.
| What you generate | Bits | The generator calls it |
|---|---|---|
| 12 characters, letters, digits and symbols | 77.3 | Fair |
| 16 characters, letters, digits and symbols | 103.1 | Strong |
| 20 characters — the default | 128.9 | Very strong |
| 5-word passphrase | 64.6 | Fair |
| 6-word passphrase — the default | 77.5 | Fair |
| 7-word passphrase | 90.5 | Strong |
The scale is below 60 bits weak, below 80 bits fair, below 110 bits strong, and very strong from 110 up. The generator’s own defaults are measured on it like anything else — the default passphrase is rated fair, and nothing here rounds that up.
Password or passphrase?
A passphrase, for the few you do
Your master password, a device login, a Wi-Fi key you read out loud. Words drawn at random from the EFF’s list of 7,776 are easier to type and remember than the same strength in symbols — 6 of them is 77.5 bits.
Random means random
Each character is drawn without the modulo bias that quietly weakens many generators, and when a digit or symbol is required it is drawn first and the whole result shuffled, so it never sits in a predictable place.
A strong password is only useful if you keep it
Save it in a vault that encrypts it on your device before it is stored, and generate the next one where you save it.