Password Generator
Create strong, secure passwords instantly
Configure options belowPassword strength, measured in bits
I built this generator around one number: bits of entropy, a measure of how many guesses stand between an attacker and your password. Password advice drifts toward ritual, add a symbol here, swap an o for a zero there, while an attacker running stolen hashes through a GPU at billions of guesses a second cares about one thing, the size of the space they have to search. The length slider and the four character-set toggles both feed that number, and the sections below put figures on how much each one buys.
Length beats symbol soup
One added bit doubles the search space, so small changes compound. A 6-character password drawn from the full set the tool offers, 88 characters across upper case, lower case, digits, and symbols, holds about 39 bits, which a modern cracking rig clears in seconds. A 20-character password of nothing but lowercase letters holds about 94 bits, and brute forcing that outlasts the age of the universe. The asymmetry is in how the two ingredients scale: widening the alphabet from 26 letters to all 88 lifts each character from about 4.7 bits to 6.5, a one-time bump, while every extra character adds a full character's worth of bits, and those keep stacking.
The length starts at 16, which comes to about 103 bits with all four sets on, more than any everyday account needs. Twenty characters from the full set reach about 129. For a bank, a primary email, or a password manager's master password, I pick 20 or more. One practical wrinkle: some sites silently reject certain symbols, so if generated passwords keep failing a form, turn off the symbols toggle and add length to make up the bits.
Where the randomness comes from
That arithmetic holds only if each character is drawn at random, and randomness is where browser tools quietly fail. This generator callscrypto.getRandomValues, which draws from the operating system's cryptographic entropy pool, the same source your browser uses to negotiate TLS keys. Math.random must never generate a password: it is a deterministic algorithm with a small internal state, built for speed in games, and someone who sees a few of its outputs can reconstruct the state and predict the rest. The OS source offers no seed to recover. Generation happens entirely on your machine, with no network request. The strength meter beside the field is a quick read on length and character variety, four steps from weak to strong, not a model of real attacks, so treat it as a floor and let length do the heavy lifting.