TOOLBOX · IDENTITY
Generate Passwords.
Strong passwords or memorable passphrases from an English wordlist, generated with your browser’s random number generator and with exactly calculated entropy. Nothing is stored.
Your password
130.9 bits of entropy
log₂ of the passwords with at least one character of each type from 94 characters · 0 characters
That is between 2130 and 2131, roughly 2.6 · 1039 equally likely results. Each additional bit doubles the number of attempts an attacker needs on average.
Settings
Meets the minimum length of 15 characters under NIST SP 800-63B-4 for passwords without a second factor.
Stays in your browser: generated with your browser’s random number generator (crypto.getRandomValues), not stored and not sent. Ideally share it not by email but with a one-time link via GRID.WHISPER, and keep it in a password manager.
RECOMMENDATIONS
Length
over Rules.
NIST and the BSI rely on long, random passwords, a password manager and a second factor. Forced special characters and routine changes without cause are not part of it.
NIST SP 800-63B-4
At least 15 characters without a second factor, no composition rules, no changes without cause, allow password managers and pasting.
NIST, Section 3.1.1BSI: Creating Secure Passwords
Short and complex or long from words, a separate password for every account, plus a password manager and, where possible, a second factor.
BSIWeb Cryptography API
crypto.getRandomValues provides cryptographically strong random values. The generator discards values that would distort a uniform distribution.
W3C
NEXT
Share
Securely.
GRID.WHISPER
Share passwords with a one-time link: encrypted in the browser, deleted after expiry, no account required.
OpenPassword Manager
Store credentials encrypted in one place, generate strong passwords and share them in a controlled way within the company.
In the GlossaryMultifactor Authentication
The second factor protects even when a password falls into the wrong hands.
In the Glossary
QUESTIONS
Good to Know.
Is the password stored or transmitted?
No. Passwords and passphrases are created in your browser with its cryptographic random number generator (crypto.getRandomValues). The page does not send them, store them or write them to the address bar. They are gone when you close it; put them in your password manager right away.
How long should a password be?
NIST SP 800-63B-4 requires at least 15 characters when a password is the only factor, and at least 8 characters when it is used only together with a second factor. The German Federal Office for Information Security (BSI) describes two approaches: short and complex with at least 8 characters from four character types, or long with at least 25 characters from two character types. The default is 20 characters from all four types.
Password or passphrase?
A passphrase of random words is easier to remember and type, for example for your password manager’s master password or for signing in to your device. The BSI recommends five to six randomly chosen words. For all other accounts, a long random password in a password manager is more convenient.
What does entropy in bits mean?
It is the base-2 logarithm of the number of equally likely results. 20 characters from 94 possible ones give 20 × log₂(94) ≈ 131 bits; six words from 2048 give 6 × 11 = 66 bits. Each bit doubles an attacker’s effort. The calculation only holds for true randomness: a self-invented password such as “Summer2026!” has far less.
Where does the English wordlist come from?
From the BIP-0039 English wordlist (bitcoin/bips), published under the MIT License. It contains 2048 words of three to eight lowercase letters, each identified by its first four letters. It has the same size as the German list, so a passphrase has the same entropy in both languages. The list is taken unchanged; an automated test compares it with the checksum of the original file.
Can I check an existing password here?
No, deliberately not. A real password belongs only in the service it is for and in your password manager, not in a checking page. Generate a new one instead.
TOOLBOX
More
Tools.
Microsoft 365 domain check
Tenant, Exchange Online, DKIM
View (German)Microsoft 365 endpoints
URLs and IP ranges for firewall and proxy
View (German)Entra ID Error Code Explainer
AADSTS50126, 53003 or 65001? Enter the code and read what is behind the sign-in error and who can fix it. 40 common codes, with a link to Microsoft.
View
YOUR NEXT STEP
You Have the Result.
What Comes Next?
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.