Why Strong Passwords Matter
In today’s digital world, your online security starts with a strong password. Weak or reused passwords are a leading cause of data breaches and account compromises.
A secure password protects your personal information, prevents unauthorized access, and keeps your accounts safe from hackers.
Tools like PassForge help you create unique, complex, and human-friendly passwords — generated locally in your browser and never sent anywhere.
What Password Entropy Actually Measures
Password strength is not measured by character count, and certainly not by whether you remembered to add an exclamation mark. It is measured in bits of entropy — a number describing how large the set of possible passwords was that yours got picked from. Every additional bit doubles the work an attacker has to do.
A 16-character password drawing on lower case, upper case, digits and symbols gives roughly 104 bits. A six-digit PIN gives about 20 bits, which falls to a brute-force attack effectively instantly. That is why PassForge shows you a concrete number underneath the field rather than a vague "weak to strong" bar: the number is something you can reason about, a coloured bar is not.
Random or Memorable
A random string of characters is more compact at any given strength, but essentially impossible for a human to memorise — those passwords only make sense when stored in a password manager. A memorable passphrase is built from separate words: it runs longer, but you can actually keep it in your head, which is what you need for the handful of passwords typed by hand — the master password for the manager itself, disk encryption, your laptop login.
One thing worth being clear about: swapping letters for lookalike characters, turning "password" into "p@ssw0rd", adds almost nothing. Cracking tools have applied those substitutions automatically for decades. Length does far more work than cleverness ever will.
How This Works
Random values come from crypto.getRandomValues(), the browser's own cryptographic generator. The ordinary Math.random() is unfit for passwords: its internal state can be reconstructed from a handful of outputs, after which the entire sequence — past and future — is computable.
Everything is generated on your device. Passwords are never sent to a server, never logged, and never stored. Closing the tab is all it takes for them to be gone.
