TabTasker
The password problem
The average person has over 100 online accounts. Each one needs a password. The recommended practice is: every password should be unique, long, and random.
The problem? Humans are terrible at creating random strings. We use birthdays, pet names, keyboard patterns, and variations of the same base password. And when one site gets breached, all your accounts suffer.
What makes a password strong
Password strength comes from entropy, which is essentially how unpredictable the password is. Two factors matter:
- Length. Every additional character exponentially increases the number of possible combinations.
- Character diversity. Using uppercase, lowercase, numbers, and symbols increases the pool of possible characters at each position.
A 16-character password with mixed character types would take a modern GPU cluster billions of years to brute-force. An 8-character lowercase-only password? Minutes.
Passphrases: the human-friendly alternative
If random strings are impossible to remember, passphrases are the alternative. The EFF (Electronic Frontier Foundation) published a word list designed for creating memorable but strong passphrases.
A passphrase like "correct-horse-battery-staple" (the classic xkcd example) has more entropy than "P@ssw0rd1" and is actually easier to remember.
Generate passwords locally
Here's the part most people don't think about: where you generate a password matters. When you use an online password generator, you're trusting that:
- The generator is truly random (not seeded predictably)
- The generated password isn't logged or stored
- The transmission back to your browser isn't intercepted
It's simpler to skip the network entirely. TabTasker's Password Generator uses your browser's cryptographic random number generator (crypto.getRandomValues) to create passwords that never leave your device.
Check your existing passwords
Curious how strong your current passwords are? TabTasker's Password Strength Checker uses the zxcvbn library to estimate crack time. Your password is analyzed locally, so it's never sent anywhere.
The complete picture
Strong passwords are just one piece. Use a password manager, enable two-factor authentication everywhere, and check Have I Been Pwned to see if your emails have appeared in known breaches.
But start with the passwords. They're the first line of defense.
Understanding entropy: the actual measure of password strength
Entropy is measured in bits and represents how unpredictable a password is. Each additional bit doubles the number of guesses an attacker needs. A password with 40 bits of entropy requires about a trillion guesses to crack by brute force. One with 60 bits requires about a billion times more than that.
In practice:
- An 8-character lowercase password has about 38 bits of entropy, crackable in minutes with modern hardware.
- A 16-character random password mixing all character types has about 105 bits, effectively uncrackable by brute force.
- A 4-word passphrase drawn from the EFF word list has about 51 bits: strong, and far easier to remember than a random string.
Why dictionary attacks change the calculation
Brute force is only one attack method. Dictionary attacks use lists of known passwords, common words, and leaked credentials from previous breaches. If your password is "dragon123" or "password!", it's in those lists and will be cracked immediately, no matter how it scores on a basic strength meter.
This is why truly random generation matters. TabTasker's Password Generator uses crypto.getRandomValues(), a cryptographically secure random number generator built into your browser. The output has no patterns, no dictionary words, and no predictability. Just entropy.
Testing your current passwords
TabTasker's Password Strength Checker uses the zxcvbn library to estimate how long your password would take to crack, accounting for dictionary attacks, common patterns, and keyboard walks, not just character diversity. It gives you an honest assessment, not a false sense of security. And it runs locally, so the password you're testing is never sent anywhere.