Quantum-Secure Password Generator
Generate a strong password
Cryptographically secure randomness, live entropy and a quantum security read-out. Nothing leaves your browser.
Length
20 charactersCharacter sets
Exclusions
Strength
—Entropy bar, capped at 128 bits.
- Entropy
- 0 bits
- Character pool
- 0 chars
- Classical crack
- —
- Quantum crack
- —
Grover's algorithm halves brute-force strength, so a password offers about entropy ÷ 2 bits against an ideal quantum attacker. Aim for the marker (≈256 bits of entropy) to reach a 128-bit quantum margin.
—Even a strong password can be phished or exposed in a breach. Passkeys are phishing-resistant, never reused and cannot leak from a stolen password database. Use generated passwords only where passkeys are not yet available.
Privacy first
Local password generation, classical and quantum aware
Randomness comes from the Web Crypto getRandomValues generator — the same cryptographically secure source used for keys — not Math.random. Your passwords, character choices and exclusions are never uploaded, there are no trackers, and the tool keeps working offline after load.
How is password strength measured?
Entropy is computed as length × log₂(pool size) — the honest upper bound for a uniformly random password. More characters and a larger pool both raise it.
What does “quantum-secure” mean here?
An ideal quantum attacker running Grover’s algorithm roughly halves brute-force strength, so a password offers about entropy ÷ 2 effective bits. Around 256 bits of entropy are needed for a 128-bit quantum margin.
Are the crack-time estimates exact?
No — they are order-of-magnitude guides. The classical figure assumes a fast offline attacker (~10¹¹ guesses/s); the quantum figure applies the Grover speed-up. Real attacks vary with the hashing scheme.
Should I use passkeys instead?
Where supported, yes. Passkeys are phishing-resistant, never reused and cannot leak from a breached password database. Use a strong generated password only where passkeys are unavailable.