How the passwords are generated
Each password is built in your browser from a pool made of the character sets you tick. The sets are fixed: lowercase a-z (26), uppercase A-Z (26), digits 0-9 (10) and 23 symbols: !@#$%^&*()-_=+[]{};:,.?. For every position the tool asks crypto.getRandomValues, the browser's cryptographically secure generator, for a 32-bit number and takes it modulo the pool size. It does not use Math.random, which is predictable and unsuitable for secrets. Taking a modulo introduces a bias of roughly pool size divided by 232, about two in a hundred million for the full pool, which is far too small to help an attacker.
The slider runs from 6 to 64 characters, and a new password appears whenever you move it or change a checkbox. Nothing is sent over the network.
Entropy: why length wins
A random password's strength in bits is length × log2(pool size). With all four sets ticked the pool is 26 + 26 + 10 + 23 = 85 characters, so each character adds about 6.41 bits.
| Setup | Pool | Entropy |
|---|---|---|
| 12 characters, all sets | 85 | about 76.9 bits |
| 16 characters, all sets | 85 | about 102.6 bits |
| 20 characters, letters and digits only | 62 | about 119.1 bits |
That last row is the useful surprise: a 20-character password with no symbols beats a 16-character one with every symbol. When a site rejects symbols, make the password longer instead of weaker.
The built-in strength bar
The bar under the password is a simple checklist, not an entropy calculation. It awards a point for 12 or more characters, another for 16 or more, one for mixed case, one for a digit and one for a symbol, then caps the result at four. For a proper score with pattern penalties and crack-time estimates, paste a password into the password strength checker.
Common mistakes
- Not every class is guaranteed. The generator does not force one of each type. With all four sets on and 16 characters, there is about a 13% chance (roughly one in seven) that no digit appears. That does not weaken the password, since it is still drawn uniformly from the pool, but it can trip a site that insists on a digit. Press regenerate and try again.
- Reusing a good password. A 100-bit password is worthless if the same one protects ten sites and one of them leaks. Use a password manager and one password per account.
- Forced rotation. NIST SP 800-63B advises against periodic password changes without evidence of compromise, and recommends allowing long passwords (at least 64 characters) rather than imposing composition rules.
- Saving it in a plain note or chat. Generate, paste straight into the manager or the sign-up form, and close the tab.
If you need a unique identifier rather than a secret, the UUID generator is the better fit.