Why Strong Passwords Matter
Most compromised accounts in leaked databases fall to predictable passwords and password reuse. Attackers do not guess one by one; they run lists of millions of leaked passwords on hardware capable of billions of attempts per second. Every "name + birth year" or "word + 123" pattern sits at the top of those lists. The only real defence is a random, unique password for every account.
This tool offers two modes: a classic random password (8–64 characters, selectable character sets) and a memorable Turkish word-based passphrase. Generation happens on the server with a cryptographically secure random number generator (CSPRNG); the result is returned only to your page and is never stored or logged.
How to Use It
- Pick a mode: random password for maximum strength, passphrase for memorability.
- Adjust the settings: length and character sets (lowercase, uppercase, digits, symbols) in password mode; word count (3–8) in passphrase mode.
- Click generate: the password comes with an estimated entropy value; regenerate as often as you like.
- Save it in a password manager: add the result to your browser's or a dedicated manager's vault.
Entropy: the Real Measure of Password Strength
Password strength is not "does it have a symbol" — it is entropy, the size of the possibility space in bits. Every additional bit doubles the number of combinations an attacker must try. Each randomly chosen character contributes log₂ of the pool size — about 6.3 bits per character with all four sets enabled. A fully random 16-character password reaches ~100 bits, practically uncrackable with current hardware. As a rough guide: below 60 bits is weak, 80 bits and above is strong. The crucial caveat: entropy only applies to random choices. "P@ssw0rd2026!" looks complex but is a predictable human pattern that already sits in attack dictionaries.
How Attackers Actually Steal Passwords
- Dictionary attacks: millions of leaked real passwords and common patterns (word+year, keyboard walks) are tried in order. A randomly generated password appears on none of those lists.
- Brute force: every combination is tried one by one — the exact scenario entropy defends against. Each extra character multiplies the time required.
- Credential stuffing: an email+password pair leaked from one site is tried on others. The defence is not password strength but a different password per account.
- Phishing: a fake login page asks you for the password directly. The only effective countermeasure is two-factor authentication.
When Does a Passphrase Make Sense?
Remembering "bulut-kartal-liman-melodi-47" is far easier than remembering a short string like "xK9#mQ2v" — and thanks to its length it beats many short "complex" passwords. But let us be honest: the word pool in this tool is limited, so a passphrase carries less entropy than a fully random password of the same length; the bit value on the result screen tells the true story. Practical advice: use long random passwords for accounts stored in a password manager, and a 6+ word passphrase for the few master passwords you must memorise (such as the manager itself).
Password Hygiene: Three Rules
- One password per account: reuse means a breach at the weakest site opens all your accounts.
- Use a password manager: memorising dozens of random passwords is impossible; a manager generates, stores and fills them.
- Turn on two-factor authentication: even the strongest password can be phished; 2FA makes a stolen password useless on its own.
Easily confused characters such as l, I, O, 0, 1 are excluded from the pools, so you will not make mistakes reading a password over the phone or typing it by hand. At least one character from every selected set is guaranteed to appear. If you would like to plan your organisation's security requirements — password policies, access management, hardened infrastructure — get in touch or see our maintenance and support service.