Every account breach has the same epilogue: the passwords that fall first are the ones a human invented — a name, a year, a keyboard pattern, the same favourite reused everywhere. This generator does the inventing properly: it picks characters at random on your own device, at a length you choose, and tells you honestly how strong the result is.
Why length beats complexity
A password's strength comes from the number of possibilities an attacker would have to try. Every extra character multiplies that number by the size of the character pool — so going from 10 characters to 16 does not make a password “a bit” stronger, it makes it millions of times stronger. Clever substitutions barely help by comparison: attackers' dictionaries already contain “P@ssw0rd”-style tricks, leetspeak and trailing exclamation marks. Length is the lever that matters, which is why this generator's slider runs to 64 characters and why a long password you store in a manager beats a short, tortured one you try to remember.
Entropy, explained
Strength is measured in bits of entropy — the base-2 logarithm of the number of possible passwords. The formula is simple:
Entropy = length × log₂(pool size)
With all four character sets ticked, the pool here is 79 characters (the sets deliberately leave out look-alikes — no I, l or O beside 1 and 0 — so a password stays readable when you must type it by hand). A 16-character password from that pool carries 16 × log₂(79) ≈ 101 bits of entropy. For scale: below 50 bits is fair game for a determined offline attack, 70 bits is strong, 90 and above is beyond any realistic brute-force attempt with current technology. The strength word at the top of this page is read straight off that scale — no theatre, just the arithmetic.
How the randomness works
Characters are chosen with the browser's cryptographic random source, getRandomValues — the same source used for secure connections — with at least one character guaranteed from every set you tick, and the finished password shuffled so those guaranteed characters can land anywhere. Never trust a password made with Math.random alone for a real account: it is predictable in ways that matter to attackers. A plain Math.random fallback exists in this page only so that ancient browsers do not break entirely. The password itself exists only in this page, in your browser's memory. It is not sent to a server, not logged and not stored; reload the page and it is replaced.
Worked example
The password already showing when this page loaded is a worked example: 16 characters drawn from the full 79-character pool, which the formula above rates at about 101 bits — “Excellent”. Drag the length down to 8 and watch the same pool drop to roughly 50 bits and the rating fall towards “Fair”: same characters available, half the length, and a password an attacker could try exhaustively many thousands of times sooner. Then untick Symbols and see the pool shrink and the entropy fall again — every option on this page feeds the one formula.
How to use this tool
- Choose a length — 16 is a good default; use 20 or more for an account that really matters.
- Tick the character sets the site you are signing up to allows (all four, unless it forbids symbols).
- Note that changing any option generates a fresh password automatically, so the password on screen always matches the options beside it.
- Press Generate new password if you want another roll of the same settings.
- Copy the password straight into your password manager and the sign-up form — never carry it through a note or a message to yourself.
Using generated passwords well
A strong password protects one account. Reusing it — however strong it is — links all your accounts together, because sites do get breached and the first thing attackers try is the leaked password on every other service. The workable system is: one generated password per account, kept in a password manager (your browser's built-in manager counts), protected in turn by one long passphrase you actually memorise and by two-factor authentication wherever it is offered. For the handful of passwords you must type by hand — a computer login, the manager itself — length still wins: four or five random words joined together are both memorable and strong, far better than a short string of substitutions you will forget by Friday.