Password Generator
Generate cryptographically secure passwords using your browser's built-in crypto.getRandomValues(). Nothing is ever sent to a server — all generation happens locally in your browser.
| Agency / Standard | Minimum Length | Complexity Rules? | Key Advice |
|---|---|---|---|
| 🇺🇸 NIST SP 800-63B (US) | 8 chars (12+ recommended) | No mandatory complexity | Check against breach lists |
| 🇬🇧 NCSC (UK) | 12 chars or 3 random words | No | 3 random words is equally valid |
| 🇦🇺 ACSC (Australia) | 14 chars (privileged) | No | Passphrases recommended |
| 🇪🇺 ENISA (EU) | 12+ chars | Recommended but not mandatory | Use password manager |
| 🇩🇪 BSI (Germany) | 12+ chars | Recommended | Avoid dictionary words |
Frequently Asked Questions
How long should a password be in 2024?
NIST (US), NCSC (UK), and ACSC (Australia) all recommend 12–16 characters as the minimum for personal accounts, and 16–20+ for critical accounts (banking, primary email, work). Modern password crackers can test billions of simple 8-character passwords per second using GPU acceleration. A random 16-character password with mixed characters would take trillions of years to crack with today's hardware.
Why did NIST stop requiring special characters?
NIST SP 800-63B (2017) reversed the old complexity rules (must contain uppercase, number, symbol) because research showed they backfired — users create predictable patterns like Password1! rather than truly random passwords. Length provides much stronger security than forced complexity. NIST now says: allow any printable character, check against breach databases, don't force periodic rotation, and focus on length.
What is the NCSC "three random words" recommendation?
The UK's National Cyber Security Centre (NCSC) recommends creating passwords from three random words concatenated (e.g., CoffeeLampBridge). This creates a memorable 15–20 character password with high entropy. It's particularly good for accounts you type manually. For accounts where you use a password manager, fully random long passwords are still optimal.