Question 1

What makes a password strong?

Accepted Answer

A strong password has high entropy — it is long and uses a large character set. A 16-character password using uppercase, lowercase, digits, and symbols has ~105 bits of entropy, making brute-force attacks computationally infeasible. Key factors: length (most important), character variety (uppercase + lowercase + digits + symbols), no dictionary words or patterns, and uniqueness (never reused across sites). NIST guidelines recommend at least 12 characters; 16+ is safer.

Question 2

What is the difference between password length and entropy?

Accepted Answer

Entropy (measured in bits) quantifies how unpredictable a password is. Formula: entropy = length × log2(character_set_size). A 12-character lowercase password (26 chars) has 12 × 4.7 ≈ 56 bits. A 12-character password with 95 printable ASCII chars has 12 × 6.57 ≈ 79 bits. Each additional bit doubles the search space. Adding one character is more effective than adding character types: a 16-character lowercase password (75 bits) is stronger than a 10-character mixed-case+symbol password (65 bits).

Question 3

Should I use a passphrase or a random character password?

Accepted Answer

Both can be equally secure at equivalent entropy. A 4–5 word diceware passphrase (e.g., 'correct horse battery staple') has ~51–64 bits of entropy and is much easier to memorize than a random character string. Random character passwords (e.g., 'Kx9#mLq2') are harder to remember but shorter for equivalent entropy. For master passwords (password managers, encryption keys) — use a long passphrase. For account passwords managed in a password manager — use random characters.

Question 4

Is it safe to generate passwords in a browser?

Accepted Answer

Yes — this tool generates passwords using the browser's Web Crypto API (crypto.getRandomValues), which uses the OS cryptographically secure pseudorandom number generator (CSPRNG). Passwords are generated entirely in your browser and never transmitted anywhere. You can verify this by turning off your network connection and generating passwords — they will still work. For critical use cases, you can also use a CLI: openssl rand -base64 32 or python3 -c 'import secrets; print(secrets.token_urlsafe(32))'.

כלים חינמיים למפתחי אתרים

מחולל סיסמאות

הגדרות

צור

סיסמה/סיסמאות

כיצד מחולל הסיסמאות עובד

מה הכלי עושה

מקרי שימוש נפוצים למפתחים

פורמטי נתונים, טיפוסים או וריאנטים

מלכודות נפוצות ומקרי קצה

מתי להשתמש בכלי הזה לעומת קוד