How to use the password generator
- A new password appears as soon as the page loads.
- Drag the length slider. 16 to 20 characters suits most accounts.
- Turn character sets on or off: uppercase, lowercase, numbers and symbols. The password always includes at least one character from every set you select.
- Select Generate new password until you get one you like, then select Copy password.
- Paste it straight into your password manager and the site’s sign-up form.
How the passwords are generated
The tool asks your browser’s cryptographic random number generator (crypto.getRandomValues) for random numbers. It is the same source browsers use for encryption keys. Each number is mapped to a character with rejection sampling, which discards values that would make some characters slightly more likely than others. One character from each selected set is placed first, then the remaining characters are drawn from the combined pool, and finally the whole password is shuffled so the guaranteed characters do not sit in predictable positions.
Strength is reported as entropy:
entropy (bits) = length × log₂(pool size)- length: number of characters in the password.
- pool size: the number of different characters it can contain. All four sets together give 26 + 26 + 10 + 25 = 87 characters.
Worked examples
Example 1: the default password
20 characters from all four sets (pool of 87):
- 20 × log₂(87) = 20 × 6.44 ≈ 129 bits, rated very strong.
Example 2: letters only
12 lowercase letters (pool of 26):
- 12 × log₂(26) = 12 × 4.70 ≈ 56 bits, rated fair. Making it 20 lowercase letters gives about 94 bits, which shows that length helps more than extra character types.
Example 3: a site that blocks symbols
A bank allows only letters and numbers, up to 16 characters (pool of 62):
- 16 × log₂(62) = 16 × 5.95 ≈ 95 bits, rated strong.
How to interpret the strength rating
| Entropy | Rating | Meaning |
|---|---|---|
| Below 50 bits | Weak | Could be cracked if a site’s password database leaks. |
| 50–69 bits | Fair | Acceptable for low-value accounts. |
| 70–99 bits | Strong | Good for most accounts. |
| 100 bits or more | Very strong | Far beyond any practical guessing attack. |
These ratings assume the password is truly random, as it is here. A password you invent yourself, like a name followed by a year, is far weaker than its length suggests.
Tips and common mistakes
- Length beats complexity. A 16-character password or a five-word passphrase is far stronger than a short one with symbols swapped in.
- Never reuse passwords. One breach then unlocks every account that shares it. Use a different password for each site.
- Use a password manager. It remembers unique passwords for you, fills them in only on the right site and makes long passwords practical.
- Turn on two-factor authentication. Even a strong password can be phished; a second factor stops most account takeovers.
- Avoid personal details. Names, birthdays, pets and keyboard patterns are the first things attackers try.
Assumptions and limitations
- Strength figures assume an attacker knows which character sets you used but nothing else.
- A strong password does not protect you from phishing or malware. Turn on two-factor authentication wherever it is offered.
- The tool does not store or remember passwords. If you close the page before copying, the password is gone.