Password Generator

Every online account you have is protected by a password — a single string of characters standing between your personal data and a potential breach. Yet studies consistently show that most people reuse passwords, choose predictable patterns, and underestimate how quickly attackers can crack weak credentials. Understanding how password generation works at a cryptographic level is the first step toward genuinely protecting your digital life.

How Cryptographic Randomness Works

The foundation of a strong password is unpredictability. ForgePlug's password generator uses the Web Crypto API — specifically the crypto.getRandomValues() function — to produce cryptographically secure random numbers. This is the same standard that browsers use for TLS/SSL certificate generation, and it relies on the operating system's entropy pool: a collection of unpredictable physical events like mouse movements, keyboard timing, and hardware interrupts.

The critical difference between cryptographic randomness and pseudo-randomness (such as Math.random()) is that the latter can be predicted if you know the seed value. A cryptographically secure generator produces output that is computationally infeasible to predict, even if an attacker has extensive knowledge of the system. This distinction is what separates a password that resists brute-force attacks from one that falls in seconds.

Entropy: Measuring Password Strength

Entropy is the standard metric for measuring password unpredictability, expressed in bits. A password with 128 bits of entropy has 2^128 possible combinations — a number so large that even if every computer on Earth worked together, cracking it by brute force would take longer than the age of the universe.

The formula is straightforward: entropy equals the logarithm base 2 of the total number of possible passwords. For a 16-character password drawn from uppercase letters (26), lowercase letters (26), digits (10), and symbols (33) — a charset of 95 characters — the entropy is approximately 105 bits. Adding just 8 more characters brings that to roughly 141 bits, which is well beyond any practical brute-force attack.

Why Length Beats Complexity

A common misconception is that mixing character types (uppercase, lowercase, numbers, symbols) is the most important factor in password strength. In reality, length has a far greater impact. A 32-character password using only lowercase letters has approximately 151 bits of entropy — stronger than a 10-character password using every character type (approximately 65 bits).

This is because each additional character multiplies the total number of possible passwords by the charset size. Going from 10 to 20 characters with a 95-character charset increases the search space from 6 × 10^19 to 4 × 10^39 — a quadrillion-fold increase. Going from 20 to 30 characters multiplies it by another quintillion.

How Crack Time Is Estimated

Password crack time estimates assume an attacker with access to modern GPU hardware, which can test billions of password hashes per second. The estimates in ForgePlug's generator assume a rate of 10^12 (one trillion) guesses per second, which is realistic for a well-resourced attacker using optimized hardware against a single hash.

These estimates provide a useful baseline, but real-world security depends on how the service stores your password. Services that use slow hashing algorithms (like bcrypt, scrypt, or Argon2) with unique salts can reduce the effective guessing rate from trillions per second to hundreds or thousands per second, dramatically increasing the time required to crack even moderate-strength passwords.

Practical Password Recommendations

• Use a password manager: Store unique, randomly generated passwords for every account. A password manager is the single most impactful security tool for most people.
• Aim for 16–24 characters: This provides excellent security while remaining manageable for most password managers.
• Use 32+ characters for critical accounts: Email, banking, and your master password should use the longest passwords your systems can accept.
• Avoid personal information: Birthdays, names, pet names, and common substitutions (like 0 for O) are the first things attackers try.
• Enable two-factor authentication: A strong password combined with 2FA provides defense in depth — even if your password is compromised, the attacker needs the second factor.