The Real Cost of a Bad Password

"Use a strong password" is advice everyone's heard and almost nobody can act on, because "strong" is vague. Strong compared to what? Checked how?

Making the Consequences Visible

When we built the Password Generator, the goal wasn't just to spit out random characters — plenty of tools do that. It was to make the consequences of password strength visible, not abstract. That's why the tool shows an estimated crack time alongside every password it generates. Not a color-coded bar labeled "good," an actual estimate: this password would take a certain class of attacker roughly this long to break through brute force.

That number changes everything about how people use the tool. A password that "feels" random but is actually eight characters with predictable substitutions (like P@ssw0rd1) might crack in seconds. Extend it, mix character types, and the number jumps from seconds to centuries. Seeing that jump happen in real time teaches the lesson faster than any advice article does.

Guarantees, Not Luck

We also built in guarantees that don't rely on luck: force inclusion of all character types instead of hoping random generation happens to include a symbol; an option to exclude ambiguous characters (like 0 and O) for passwords you'll actually need to type by hand; bulk generation for anyone managing multiple accounts at once. All of it runs through crypto.getRandomValues — the browser's actual cryptographic random source, not a weaker pseudo-random function that just looks random.

None of this is complicated. It's mostly about refusing to hide the stakes behind vague reassurance, and letting the number do the convincing instead.