Password generator

What makes a password strong

Strength comes from unpredictability, measured in bits of entropy. A password drawn uniformly from an alphabet of N characters, L characters long, has L × log₂(N) bits. With all four character sets (76 characters) each character adds about 6.2 bits, so 16 characters give about 100 bits and 20 characters about 125 bits: far beyond what any attacker can try, even against a fast hash.

Length matters more than complexity. NIST's current guidance (SP 800-63B) drops forced composition rules and periodic changes and asks sites to accept long passwords. The best practical setup is a password manager generating a unique 16–24 character password for every site.

Worked example

Twenty characters from lowercase, uppercase, digits and the 14 symbols here: 20 × log₂(76) ≈ 125 bits. Guessing that at a trillion attempts per second would take far longer than the age of the universe. A 6-digit PIN, by comparison, has under 20 bits.

Look-alike characters

Turn on avoid look-alikes if you will read the password aloud or type it from paper: it removes I, l, 1, O, 0 and o at a small cost in entropy.

Every character comes from crypto.getRandomValues, the browser's cryptographically secure random generator. To avoid bias, the page uses rejection sampling: random 32-bit numbers that would favour some characters are discarded and redrawn. It first takes one character from each set you selected, fills the rest from the combined alphabet, and shuffles the result with a Fisher–Yates shuffle using the same secure source. The entropy shown is length × log₂(alphabet size). Passwords are created only in your browser and are never sent, logged or stored.