Password Generator

Randomness a browser can actually vouch for

A password is only as good as the process that produced it. This generator draws every character from the browser’s cryptographic random number generator, which is designed to be unpredictable even to someone who knows every other password it has produced. It never uses Math.random(), which is fast, seeded and entirely predictable to an attacker who can observe a few outputs — fine for shuffling a playlist, disqualifying for generating a secret.

How the strength figure is calculated

Strength is reported as entropy in bits: length × log2(pool size), where the pool is the total number of distinct characters available. With uppercase, lowercase, digits and symbols all enabled the pool is 88 characters — 26 + 26 + 10 + 26 — and log2(88) is about 6.46 bits per character.

So a 16-character password from the full set carries about 103 bits, meaning roughly 2^103 equally likely possibilities. An 8-character password from the same set is 52 bits, a 12-character one is 78, and a 24-character one is 155. The tool labels anything under 40 bits weak, under 60 fair, under 80 strong and 80 or more very strong.

Length beats variety, and not by a little. Sixteen lowercase letters alone is 75 bits — within a hair of the 78 bits that twelve characters from all four sets provide, and far beyond the 52 bits of an eight-character password using every set available. Adding a symbol to a short password adds a few bits; adding four more characters adds twenty-six.

The options, and what they cost

Selecting a character type guarantees at least one of it, rather than leaving it to chance: one character is drawn from each selected set first, the rest are drawn from the combined pool, and the whole thing is shuffled so the guaranteed characters are not clustered at the front. This matters because many sites reject a password that happens to contain no digit.

"No look-alikes" removes the characters people confuse when reading a password aloud or copying it from a screen — 0 and O, 1 and l and I, and the vertical bar and quote marks. It shrinks the pool from 88 to 83, which costs about one bit on a 16-character password: 102 instead of 103. That is a trivial price for a password you have to type into a television.

What the entropy figure assumes

The bit count is only valid for a password generated exactly this way — uniformly at random from a stated pool. It is not a measure you can apply to a password a human invented. "Password1!" draws from the same 88-character pool and would score 65 bits on that formula, and it would be cracked instantly, because attackers do not guess uniformly at random. They start with leaked password lists, dictionary words, keyboard runs, substitutions like @ for a, and appended years.

The number also says nothing about what happens after generation. A strong password stored in a text file, reused across sites, or typed into a phishing page is compromised regardless of its entropy. Generate it here, put it straight into a password manager, and enable multi-factor authentication on anything that matters — the generator runs entirely in your browser and keeps no record of what it produced, so there is nothing to recover if you lose it.