Question 1

How is crack time estimated?

Accepted Answer

Entropy in bits converts to guesses (2^(bits−1) on average), divided by 10 billion guesses/sec — a strong offline attack. It's an estimate with stated assumptions, not a guarantee.

Question 2

Are memorable passwords weaker?

Accepted Answer

Per character, yes — words carry ~10 bits each here versus ~6 bits per random character, so use at least 4–5 words. Their strength is length, and they're far better than reusing a short password.

Question 3

Is my password sent anywhere?

Accepted Answer

No. Generation and the top-10k dictionary check run 100% in your browser with crypto.getRandomValues(). Nothing is uploaded, logged, or transmitted.

Question 4

What if my password is in the top-10k list?

Accepted Answer

Treat it as compromised — attackers try those first, regardless of entropy. Change it everywhere you reuse it, and switch on two-factor authentication.

Password Generator + Strength Checker

What you can do

FAQ