What the results show
- The password — a fresh random string built from the character types you enable. It includes at least one character from every selected set, so a password that allows symbols always contains one.
- Strength — a coarse rating (Weak, Fair, Strong, Very strong) based on how hard the password would be to guess.
- Entropy in bits — the number of bits of randomness. More bits means exponentially more possible passwords; roughly 60 bits is strong and 80+ is very strong.
How it works
Each character is chosen with your browser's cryptographically secure random number generator (crypto.getRandomValues) — the same class of randomness used for encryption keys, not the predictable Math.random. Indexes are drawn with rejection sampling so every character in the pool is equally likely, with no bias toward the start of the set.
Strength is estimated as length × log₂(pool size). Adding more character types enlarges the pool, and each extra character multiplies the number of possibilities — which is why a longer password almost always beats a shorter, more complex one.
Frequently asked questions
Is my password sent anywhere or saved?
No. The generator runs entirely in your browser. Passwords are created on your device and are never uploaded, logged, or stored — reloading the page discards them.
How long should my password be?
For most accounts, 16 or more characters with a mix of types is a good target. If a site allows it, longer is better — length adds strength faster than complexity does.
What does “exclude ambiguous characters” do?
It removes look-alike characters such as lowercase l, uppercase I, the digit 1, and O versus 0. That makes a password easier to read or type by hand, at the cost of a slightly smaller character pool.
Why does it show a dash instead of a password?
A dash appears when no character type is selected, because there are no characters to draw from. Enable at least one of lowercase, uppercase, numbers, or symbols and a password appears instantly.
Is this random enough to be secure?
Yes.
crypto.getRandomValues is a cryptographically secure source, and the unbiased sampling means every password of a given length is equally likely. The entropy readout tells you how much randomness each one carries.Should I reuse a generated password?
No — use a unique password for every account and store them in a password manager. Reusing one password means a breach on any single site puts all of them at risk.