Password Generator

A password is only as good as its randomness. This generator draws every character from crypto.getRandomValues — the browser's cryptographically-secure pseudo-random number generator (CSPRNG) — so the output has no predictable pattern an attacker can exploit. Choose the length, pick which character classes to include, generate a batch, and read the entropy estimate. Nothing is sent anywhere: the passwords are produced entirely on your device and never touch a server, so they are safe to use for real accounts.

Why not a "clever" human password. People pick memorable passwords, and memorable means predictable: dictionary words, keyboard walks, a name and a year, a capital at the front and a ! at the end. Attackers know these patterns and try them first with wordlists and rules, so a human-chosen password with "good complexity" often falls in seconds. A random password has no pattern to attack — the only route left is brute force across the full keyspace.

How strength is measured. Entropy in bits is length × log2(pool size), where the pool is the number of distinct characters you allow. A 20-character password over the ~94-character printable set carries roughly 131 bits — far beyond what any foreseeable brute-force effort can search. Length is the most powerful lever: adding characters multiplies the keyspace far faster than adding exotic symbols. The tool guarantees at least one character from each class you enable, then shuffles, so requirements are met without weakening randomness.

Options that matter. Exclude look-alikes removes O/0, l/1, and I for passwords you must transcribe by hand or read aloud; it trims the pool slightly, so compensate with a little more length. Symbols expand the pool but some systems reject certain characters — if a site refuses a password, drop symbols and add length instead.

Common mistakes. Reusing one strong password everywhere (a single breach then unlocks everything), storing passwords in a spreadsheet or notes app, and treating complexity rules as a substitute for length. A 12-character random password beats a tortured 8-character one with every rule satisfied.

Defensive angle. Use a password manager so every account gets a unique, long, random password you never have to remember, and turn on multi-factor authentication so a single leaked password is not game over. Curious how a candidate scores? The password strength checker shows its entropy and estimated crack time. If you operate a service, store passwords only as salted Argon2id or bcrypt hashes — never a fast SHA digest — block known-breached passwords at signup, and favor length requirements over arbitrary symbol rules.