Password Generator

Strength is measured in bits of entropy: how many guesses an attacker would need, written as a power of two. Each extra character multiplies the guesses by the size of the character pool, so adding length helps far more than swapping a letter for a symbol.

• Under 60 bits — weak. Within reach of a determined offline attack.
• 60 to 79 bits — fair. Acceptable for low-value accounts with rate limits.
• 80 to 99 bits — strong. The sensible target for email, hosting and admin logins.
• 100 bits and more — very strong. Right for API keys, database users and secrets.

The figure shown is the pool size raised to the length. It describes how the password was made, which is the only honest measure of a random password.

• One password per account. A password reused anywhere is only as safe as the weakest site that holds it. A password manager — Bitwarden, 1Password, KeePassXC — makes this practical.
• Sixteen characters or more. Generated, not invented: people pick patterns, and attackers guess patterns first.
• Turn on two-factor sign-in for email, domain registrar, hosting and banking. A strong password does not help once it has been phished; a second factor still does.

The password is made by your browser’s own cryptographic random number generator (crypto.getRandomValues), with no bias toward any character. It is not sent to Onduu, not logged, not stored and never put in the address bar. You can confirm this in your browser’s developer tools: pressing Regenerate makes no network request.

Where the password protects a domain or mailbox, the next step is checking the rest of the setup: Domain Health for who controls the domain and Email Health for whether someone can send mail as you.