Password Generator

How to use the password generator

1. Set the password length — type it in the box or drag the slider, which move together. Anywhere from 4 to 128 characters.
2. Choose which character types to include: lower case, upper case, numbers and symbols.
3. Optionally exclude the ambiguous characters, the brackets, or repeated characters.
4. Press Generate, then Copy to place the password on your clipboard, or Regenerate for another one from the same settings.

If you change a setting after generating, the password on screen is marked as out of date and Copy is disabled until you press Generate again — so you never copy a password that no longer matches what is on the form. Clear puts every setting back to its default. You must keep at least one character type selected, and with repeated characters switched off the length cannot exceed the number of characters available.

How it generates a password

Each character is chosen with the browser's Web Cryptography API (crypto.getRandomValues), which provides cryptographically strong randomness rather than the predictable kind used for ordinary shuffling. The generator guarantees at least one character from every type you selected, fills the rest from the combined pool, then shuffles the whole thing so those guaranteed characters are not stuck in fixed positions. Each draw is taken by rejection sampling rather than a remainder, so no character is very slightly more likely than another.

Everything happens on your device. Nothing you generate is transmitted to a server, logged or stored, so the password exists only in your browser until you copy it.

What makes a password strong

Two things: length and variety. Every character you add multiplies the number of possible passwords, and every character type you enable widens the pool each position is drawn from. Length is the more powerful lever — adding characters strengthens a password faster than swapping in the odd symbol — which is why 16 characters is a good floor wherever a site allows it.

How the strength meter works

The meter estimates entropy in bits — a measure of how unpredictable the password is. It multiplies the length by the number of bits each character contributes, which depends on the size of the pool you are drawing from:

entropy (bits) = length × log₂(pool size)

The pool is the one actually drawn from, after your exclusions — not the one on offer. With repeated characters switched off each position has one fewer choice than the last, so the bits are summed as log₂(pool) + log₂(pool − 1) + … instead, which is genuinely a little lower.

Character type	Characters in the pool
Lowercase	26
Uppercase	26
Digits	10
Symbols	32
All four together	94
All four, ambiguous and brackets excluded	70

More bits means a stronger password. The meter rates anything below 40 bits Weak, 40–59 Fair, 60–89 Strong, and 90 bits or more Very strong.

A length and strength reference

Using all four character types (a pool of 94) unless noted, entropy climbs quickly with length:

Length & types	Approx. entropy	Rating
8, lower case only	37.6 bits	Weak
8, all four types	52.4 bits	Fair
10, all four, both exclusions on	61.3 bits	Strong
12, all four types	78.7 bits	Strong
16, all four types	104.9 bits	Very strong
20, all four types	131.1 bits	Very strong

The jump from an 8-character lowercase password to a 16-character mixed one is the difference between something a modern machine can grind through and something it cannot.

Common mistakes to avoid

• Reusing a password across accounts — one breach then exposes all of them.
• Basing it on a word, name or date, which guessing tools try first no matter how you decorate it.
• Predictable substitutions like P@ssw0rd — attackers know every one of them.
• Going too short to save typing; length is where the real strength lives.
• Changing passwords on a fixed schedule with no cause, which tends to push people toward weaker, patterned variations.

Storing passwords safely

A strong password only helps if you can keep it unique per account, which is more than anyone can memorise. Pair the generator with a reputable password manager to store them, and turn on two-factor authentication wherever it is offered. Change a password when there is a reason — a breach or a phishing scare — rather than on a timer. If you need random numbers rather than passwords, use the random number generator.