Sources and references
Resources used to build the site
- Cooltext.com, for the site logo.
- Flaticon.com, for the interface icons.
- Passwords are generated with PHP's
random_int(), which draws from the operating system's cryptographic random source. The in browser regenerate button uses the Web Crypto API'scrypto.getRandomValues().
References behind our password advice
The recommendations on our strength, passphrase and advice pages are drawn from published guidance and research rather than from opinion. The main sources:
- NIST Special Publication 800-63B, Digital Identity Guidelines, revision 4 (National Institute of Standards and Technology, 2025). The source for the minimum length of 15 characters when a password is the only authenticator, the requirement to accept at least 64 characters, the prohibition on composition rules, the removal of scheduled password expiry, and the requirement to screen new passwords against breach lists. pages.nist.gov/800-63-4
- UK National Cyber Security Centre, password guidance. Reached the same conclusion on scheduled rotation several years before NIST, and is the source for the practical framing of what forced changes do to user behaviour. ncsc.gov.uk
- Diceware, Arnold G. Reinhold, 1995. The original method for generating passphrases from physical dice rolls and a numbered word list. theworld.com/~reinhold/diceware.html
- EFF word lists for random passphrases, Electronic Frontier Foundation, 2016. The source of the 7776 word long list and the 1296 word short list used in our comparison table. eff.org/dice
- Have I Been Pwned, Troy Hunt. The reference breach corpus, and the source for the k-anonymity method used by password checkers. haveibeenpwned.com
- Hashcat benchmark data, for the guessing rates used in our crack time tables. The rates quoted assume a multi GPU rig against a fast unsalted hash, and are stated as assumptions rather than as facts about any particular site.
- zxcvbn: Low-Budget Password Strength Estimation, Daniel Lowe Wheeler, USENIX Security 2016. The basis for our claim that pattern aware strength meters are far closer to reality than character class counters.
- OWASP Password Storage Cheat Sheet, for the current recommendations on Argon2id, bcrypt and PBKDF2 parameters referenced on the password manager page. cheatsheetseries.owasp.org
A note on our figures
The crack times we publish are computed directly from entropy and a stated guessing rate, not copied from another site. They assume the password is genuinely random, which is the only case where the arithmetic is honest. Where we quote a rate, we say what hash and what hardware it assumes, because that assumption changes the answer by seven orders of magnitude and is usually left out.