QoinHow the strength estimate works
The estimate assumes an attacker who tries every possible combination offline at 10 billion guesses a second, a rough figure for a fast hash on modern graphics cards. The number of combinations is the alphabet size to the power of the length: 16 characters from the 83 symbols of this generator give about 5 × 10³⁰ options, roughly 16 trillion years at that rate. That is why length beats complexity: four more characters multiply the work by about 47 million, switching on symbols by about a hundred. The labels are rules of thumb for brute force alone: Weak cracks in under a week, Strong holds up to a year, Very strong up to ten years, Uber strong longer than that. A password reused across sites or leaked elsewhere is weak at any length.
The symbol set leaves out quotes, commas, periods, semicolons, the backslash and the vertical bar, so a password pastes cleanly into forms, config files and command lines. Easy to read drops i, I, l, L, 1, o, O and 0 for passwords you may need to type by hand or read out loud. Each password contains at least one character from every set you switch on. Everything runs in your browser with the cryptographic random generator; nothing is sent or stored, and a password manager is the right place to keep the result.