How this generator works
This tool draws every character using crypto.getRandomValues(), the
Web Crypto API's cryptographically secure random number source — not
Math.random(), which is fast but not designed to resist prediction and
should never be used for anything security-sensitive. To avoid a subtle statistical
bias that comes from converting random numbers into a smaller range (some remainders
turn up very slightly more often than others), this generator uses rejection
sampling: any draw that would introduce that bias is discarded and redrawn, so every
character is genuinely equally likely. When more than one character type is
selected, at least one character from each is guaranteed to appear, and the whole
password is shuffled afterward so those guaranteed characters don't predictably
cluster in the same positions every time.
Nothing you generate here ever leaves your browser — there's no server call involved in creating or displaying a password.
Understanding the strength meter
The strength meter provides an estimated entropy value based on password length and the effective character pool: bits ≈ length × log₂(character pool size). More bits means a larger number of possible passwords and, in general, more guesses required for an exhaustive search. Because this generator guarantees at least one character from each selected character type, the displayed value is an estimate rather than an exact measure of the generator's final password distribution.
Current NIST guidance (SP 800-63B-4) emphasizes length over forced complexity rules — a longer password with fewer character types often beats a shorter one stuffed with symbols. This tool's strength meter uses its own practical heuristic (roughly 60 bits treated as adequate for most everyday accounts, 80+ bits for higher-value ones), not a figure drawn from a specific standard — it's a rough guide, not a substitute for a site's own password policy or a proper breach/security check, and using a password manager with unique, generated passwords per site matters more than hitting any particular number.
Frequently asked questions
Is this password generator secure?
Yes. It uses the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random source, with rejection sampling to avoid statistical bias. It never uses Math.random(), which isn't designed to resist prediction and shouldn't be used to generate anything security-sensitive.
How long should my password be?
Current NIST guidance emphasizes password length over arbitrary composition requirements. For randomly generated passwords, increasing the length generally provides a much larger increase in resistance to exhaustive guessing than simply adding more character types. With all four character types selected, a 16-character password has an estimated entropy of about 100 bits using this calculator's estimate.
What does the entropy number actually mean?
It's the number of bits needed to represent how many equally likely passwords could have been generated with those settings. Each additional bit doubles the number of guesses an attacker would need to try every possibility, so higher is stronger.
Does this tool store or transmit my generated passwords?
No. The password is generated and displayed entirely in your browser; the generated password isn't sent to a server, logged, or stored by this tool.