HubTools

12 Character Password Generator

Generate a 12-character password with all character classes. ~78 bits of entropy, no server round-trip.

Is a 12-character password strong enough?

A 12-character password drawn from the full 94-character printable ASCII set gives about 78 bits of entropy — enough that a single attacker with a $20,000 GPU rig averaging ten billion guesses per second would still need decades to brute-force it offline. For most personal accounts it's a reasonable floor, but for high-value targets (banking, email, password manager master) you should prefer 16+ characters because 78 bits sits just above the threshold of what nation-state-scale compute can chew through. The password is encoded right in your browser using crypto.getRandomValues() — your data stays on your device.
Generated Password
Enable at least one character type
Fair
74.5 bits of entropy
Charset: 74 chars
Estimated crack time: 428 centuries(10 billion guesses/sec)
Bulk Generation
Count:
Options
Password Length12
4128
Character Types
Uppercase
(A-Z)
Lowercase
(a-z)
Numbers
(0-9)
Symbols
(!@#$%^&*_+-=)
Exclusions
Exclude Similar
(i,l,1,L,o,0,O)
Exclude Ambiguous
{}<>[]()/\|
Quick Presets

About 12-character passwords

12 random printable ASCII characters give ~78 bits of entropy — the practical floor for an account you intend to keep for under a decade.
  • Search space: 94^12 ≈ 4.7 × 10^23 possibilities
  • Offline brute-force at 10^10 guesses/sec: ~750,000 years average
  • Online brute-force (with rate limiting): centuries
  • Drops to ~71 bits if you exclude symbols, ~62 bits if alphanumeric-only
  • For credentials over 10 years, prefer 16+ chars

Frequently asked questions

How strong is 12 characters, really?
About 78 bits of entropy with all four character classes (94^12 ≈ 4.7 × 10^23 combinations). At 10 billion offline guesses per second that's ~750,000 years on average — strong against any practical attacker, though margin shrinks against future hardware. For lifetime credentials, prefer 16+ characters.