Password Generator

What actually makes a password strong

A password is strong when it is hard to guess, and "hard to guess" has a precise meaning: the number of possibilities an attacker would have to try. That number depends on two things — how many characters the password has, and how many options each character is drawn from. This generator uses the browser's cryptographically secure random source (crypto.getRandomValues), so every character is genuinely unpredictable, not the output of a weak Math.random.

Length matters far more than symbols. Adding one random lowercase letter multiplies the search space by 26; switching a 10-character password to 16 characters multiplies it by 26^6 — over 300 million times. This is why a long passphrase of ordinary words can be stronger than a short string of "@$!" gibberish, and much easier to type. Complexity rules exist mainly to stop people choosing "password1"; past a reasonable minimum they add little.

The threat model is offline cracking. If a service is breached and its password hashes leak, attackers run billions of guesses per second against them using wordlists, previously-leaked passwords, and predictable substitutions (a→@, o→0). A password built from real random characters has no pattern to exploit, so the only attack left is brute force — which a sufficiently long one makes infeasible.

Entropy basics: each extra bit of entropy doubles search space. Length beats complexity once attackers rely on dictionaries—prefer passphrases (long, memorable) or long random strings from a generator for machine storage.

Do / don’t: do enable a password manager; do rotate after breaches; don’t reuse banking passwords on hobby forums; don’t screenshot vault exports to cloud albums.

Related: UUIDs identify rows; passwords authenticate humans—don’t substitute one for the other.

How passwords are generated and rated

Each character is drawn from your browser’s cryptographically secure generator, with rejection sampling so every character in the set is exactly equally likely. Every character type you tick is guaranteed to appear at least once — so the password passes sites that insist on a digit or a symbol — and the positions are then shuffled. The password is created on your device and never sent anywhere.

The strength meter measures how many passwords the generator could have produced: length × log2(number of possible characters), in bits. Under 50 bits is rated weak, 50–69 fair, 70–99 strong and 100 or more very strong. Each extra bit doubles the work for an attacker.

Worked examples

Length  Character set                 Entropy   Rating
8       letters + digits (62)          48 bits  Weak
16      letters + digits (62)          95 bits  Strong
12      all four sets (88)             78 bits  Strong
20      all four sets (88)            129 bits  Very strong
64      lowercase only (26)           301 bits  Very strong

Length does more than variety: a 16-character letters-and-digits password is stronger than a 12-character one with symbols. Add symbols when a site caps the length, or when it requires them.

Passphrases for the passwords you must remember

For the few passwords you type from memory — your password manager’s master password, your computer login — a passphrase of random words is easier to remember at the same strength. With a 7,776-word list (the EFF dice list), each word adds about 12.9 bits: four words give about 52 bits, six words about 78. The words must be chosen randomly, not picked by you; a favourite quote or song lyric is easy to guess no matter how long it is.

Using generated passwords well

• Use a different password for every account, stored in a password manager. Reuse, not weakness, is how most accounts are taken over after another site is breached.
• Turn on two-factor authentication or passkeys where offered; they protect you even if a password leaks.
• Change a password when a service reports a breach, not on a fixed schedule.