A password's strength is a counting problem, not a feeling
Password strength isn't about how random something looks to a human — it's about how large the space of possible passwords is that an attacker would have to search through. Every additional allowed character type widens that space at every position; every additional character of length multiplies it. This tool generates from that math directly rather than from patterns or word substitutions, using crypto.getRandomValues — the same cryptographically secure random number source your browser relies on for TLS connections — so each character is drawn from a genuinely unpredictable, uniform distribution.
That last part matters more than it sounds: a naive random generator using something like Math.random() and a modulo operation to pick characters introduces modulo bias, subtly favoring some characters over others depending on how the character set size divides into the random number's range. This tool avoids that with rejection sampling — discarding and re-drawing any random value that would introduce that bias — so every character in the output pool is genuinely equally likely, not just approximately so.
How entropy is actually calculated
The formula is: entropy = log2(character set size) × password length. The log2 function answers 'how many yes/no questions would it take to narrow down one character from the pool,' and multiplying by length reflects that each character position adds that many bits independently, since positions are chosen independently at random.
With all four character sets enabled — uppercase, lowercase, numbers, symbols — the combined pool is 95 characters (26 + 26 + 10 + 33 printable symbols), and log2(95) is approximately 6.57. A 20-character password from that full pool gives roughly 6.57 × 20 = 131 bits of entropy — a number so large that even accounting for continual advances in cracking hardware, no realistic offline attack reaches anywhere close to exhausting that space within a meaningful timeframe.
How character set size and length trade off
| Character sets enabled | Pool size | Bits per character (approx) | 16 chars (bits) | 20 chars (bits) |
|---|---|---|---|---|
| Lowercase only | 26 | 4.70 | 75 | 94 |
| Upper + lowercase | 52 | 5.70 | 91 | 114 |
| Upper + lower + numbers | 62 | 5.95 | 95 | 119 |
| All four (+ symbols) | 95 | 6.57 | 105 | 131 |
Generating a password
Set the length with the slider (8–64 characters) — longer is stronger, and the effect compounds since entropy scales with length multiplied by the log of the pool size.
Toggle uppercase, lowercase, numbers, symbols, and exclude-ambiguous as needed.
Click Generate new to roll a fresh password.
Use the eye icon to hide or show it, and the copy icon or Copy button to grab it.
Why length matters more than character variety past a point
What 'exclude ambiguous' actually removes and why
This option strips characters that are visually similar or identical across common fonts — I, l, 1, O, 0, o — which matters specifically when a password needs to be read off a screen and typed by hand, or communicated verbally, rather than pasted directly from a password manager. Removing six characters from a 95-character pool has a negligible effect on entropy (log2(89) ≈ 6.48 versus log2(95) ≈ 6.57 — a difference of roughly 0.09 bits per character), so this is a readability trade-off, not a meaningful security trade-off.
Choosing the right length for the right context
For an ordinary site password that lives in a password manager and is never typed by hand, 16–20 characters from the full character pool is comfortably beyond what's practically crackable — there's little security benefit to going further, since you're already well past any realistic attack budget. Where this tool isn't the right fit is a master password you have to memorize and type yourself: a maximally dense 20-character random string is close to unmemorizable, and a Passphrase Generator — built around random dictionary words rather than random characters — trades some entropy density for something a human can actually retain and recall.
Common mistakes
Choosing a short length with only lowercase letters enabled, then assuming a generated (rather than human-chosen) password is automatically strong — a randomly generated 8-character lowercase-only password is genuinely weak in bits despite being unpredictable to a human.
Trying to memorize a maximum-entropy random-character password instead of using a passphrase generator for anything you need to type from memory.
Disabling symbols and numbers on a site that supports them just for typing convenience, when the site is otherwise fine with pasted passwords from a manager.
Reusing one generated password across multiple accounts — entropy measures resistance to guessing a single password, not protection if that password (or the service storing it) is compromised elsewhere.
Frequently asked questions
Q: Are these passwords safe to use?
A: Yes. They're generated with crypto.getRandomValues, the same CSPRNG your browser uses for TLS. Rejection sampling avoids modulo bias so every character is uniformly chosen.
Q: What length should I pick?
A: For site passwords stored in a manager, 16–20 characters is plenty. For a master password you must remember, prefer the Passphrase Generator instead.
Q: How is entropy calculated?
A: Entropy = log2(character set size) × length. With all four sets enabled the pool is 95 characters, so a 20-character password gives roughly 131 bits — far beyond what offline crackers can reach.
Q: What does 'Exclude ambiguous' do?
A: It removes characters that look alike (I, l, 1, O, 0, o) so the password is easier to read or type by hand, at a negligible cost in entropy.
Q: Is the password uploaded anywhere?
A: No. Generation and display are entirely local, with no network call involved.
Q: Can I generate many at once?
A: This tool focuses on one strong password at a time. For bulk PINs, use the Random PIN Generator; for bulk passwords, script the same crypto API yourself.
Generate a password now
Create a strong password with the Password Generator. Need something memorable instead? Try the Passphrase Generator. Want to check an existing password's strength? Use the Password Strength Checker, or encrypt sensitive text directly with Encrypt & Decrypt Text.
