What makes a password strong
Attackers do not guess passwords one by one by hand; they run billions of guesses per second against leaked password databases, starting with common words, names and patterns. A password resists that only if it is long and chosen at random from a large set of characters. People are poor at producing randomness, which is why a generator — combined with a password manager so you do not have to remember the result — is the practical answer. NIST also recommends a unique password for every account, so one breach does not unlock the others.
How it works
pool = union of the chosen character sets (26 + 26 + 10 + 25 = 87) 1 character from each chosen set, the rest from the whole pool, each index = uniform random integer in [0, n) from crypto.getRandomValues (rejection sampling, so no character is more likely than another) then a Fisher–Yates shuffle entropy = length × log₂(pool) bits
Worked example
Length 16, all four sets: pool = 87 characters, entropy = 16 × log₂ 87 = 16 × 6.44 = 103 bits — about 1.1 × 10³¹ possible passwords. At a trillion guesses per second, exhausting them would take over 300 billion years.
Length 8, lowercase only: 8 × log₂ 26 = 37.6 bits (2 × 10¹¹ possibilities) — under a second of offline guessing.
Notes
- Each refresh or change makes a new password. Settings (not passwords) are saved in the page address so you can bookmark your preferred length.
- Strength labels: under 40 bits very weak, 40–59 weak, 60–79 fair, 80–99 strong, 100+ very strong.
Sources: NIST, SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management; W3C, Web Cryptography API, getRandomValues(); CISA, Use Strong Passwords.
Frequently asked questions
Is this password generator safe to use?
Passwords are generated entirely in your browser with the Web Crypto API (crypto.getRandomValues), the same cryptographically secure source browsers use for encryption keys. Nothing is sent to a server, logged or stored, and the password is never placed in the page address. You can disconnect from the internet after the page loads and it still works.
How long should a password be?
NIST's digital identity guidelines (SP 800-63B) require at least 8 characters and recommend allowing 64 or more; length matters more than complexity rules. For accounts you store in a password manager, 16 or more random characters (about 100 bits of entropy) is far beyond any practical guessing attack.
What does "bits of entropy" mean?
It measures how many guesses an attacker would need: each bit doubles the count. A random password of length L from a pool of N characters has L × log₂(N) bits. 16 characters from 87 symbols ≈ 103 bits, or about 10³¹ possibilities. This applies only to truly random passwords — not ones a person makes up.
Why exclude look-alike characters?
Characters such as l, 1, I, |, O, 0 and o are easy to misread when you have to type a password from paper or another screen. Excluding them shrinks the pool slightly (lowering entropy a little), so add a character or two of length to compensate.