Security
Strong Password Generator
Passwords are built with crypto.getRandomValues, not Math.random. The strength readout is actual entropy in bits, so you can judge it instead of trusting a coloured bar.
How to use it
- Drag the slider to set the length — 16 characters is a sensible default.
- Tick the character types you want. Fewer types means a shorter alphabet, so you need more characters for the same strength.
- Press Generate until you like the result, then Copy.
- Paste it straight into a password manager.
Entropy, and why most strength bars lie
Entropy is measured in bits: the base-2 logarithm of the number of possible passwords. A 20-character password drawn from 62 characters has 20 × log₂62 ≈ 119 bits. Most strength meters do not compute this. They score for the presence of digits and symbols and then cap the result, so a 12-character password and a 40-character one both light up “strong” — while one is a trillion trillion times harder to crack than the other.
Length beats complexity
NIST withdrew its own composition rules in 2017: no forced symbol, no forced rotation, no mandatory expiry. The reasoning is arithmetic. Adding one character to a 12-character lowercase password multiplies the search space by 26; forcing one capital letter multiplies it by two. Length is the only lever that scales, which is why a four-word passphrase beats an eight-character scramble on both entropy and memorability.
What to do after generating one
A strong password you cannot remember is only useful if something remembers it for you. Put it in a password manager, and give the manager one long passphrase you do remember — four or five random words beat a short string of symbols on every measure, including memorability.
Then fix the part that actually causes breaches: reuse. One password per site means a leak at any one of them is contained. Turn on two-factor authentication wherever it is offered, preferably an app or a hardware key rather than SMS, which is defeatable by SIM swapping.
Frequently asked questions
Is this actually random?
Yes. It uses the Web Crypto API — the same randomness source browsers use for TLS keys — not the predictable Math.random used for animations.
What does “bits of entropy” mean?
It is log₂ of the number of possible passwords. Each extra bit doubles an attacker's work. Around 70+ bits is strong for online accounts.
Why are some letters missing?
Uppercase I, uppercase O and lowercase l are excluded because they are easy to confuse when read aloud or typed from a screen.
Are the passwords generated here truly random?
They come from the browser's cryptographic random source, not from Math.random, which is predictable and unsuitable for anything security-related.
Should I include symbols?
Only if the site requires them. Length is what resists guessing; symbols mostly satisfy password policies written before that was understood.