Password Generator
Xk7#mQ2vLp9$RtB4wZs6
- 76
- Alphabet size
- 125 bits
- Entropy
- 76^20
- Combinations
Very strong: the password is no longer the weak link
Entropy measures the generator, not the string. A password you invented has far less than its character set suggests, because people are not uniform random sources.
The password generator builds a password from the character sets you choose and reports its entropy in bits, which is the only honest measure of strength. Generation happens in your browser using the cryptographic random source, and nothing is transmitted.
How it works
Every character is drawn uniformly from the selected alphabet using rejection sampling, so no character is more likely than another. At least one character from each selected set is guaranteed, then the rest are filled and the whole thing shuffled.
entropy in bits = length × log2(alphabet size)
- alphabet size
- how many distinct characters could appear at each position
- length
- how many characters the password has
- All four sets gives an alphabet of 76 characters, or about 6.25 bits per character.
- A 20-character password from that alphabet is around 125 bits, far beyond brute force.
- Length matters more than variety. Adding four characters beats adding a whole character set.
- The guarantee of one character per set exists because a 12-character password from four sets omits a set about 2% of the time, which fails policies that require all four.
The number measures the generator, not the string. A password a person invented has far less entropy than its character set implies, because people pick predictable patterns, which is why "P@ssw0rd!" scores well on naive strength meters and falls to a dictionary attack in seconds.
Examples
The default
Length
20
Sets
All four
Result
Alphabet 76 · about 125 bits
log2(76) is 6.25, and 6.25 × 20 is 125. Well past the point where the password is the weak link.
Length beats variety
Compare
12 characters, 4 sets against 16 characters, 2 sets
Result
75 bits against 91 bits
The longer password with a smaller alphabet is significantly stronger. This is the single most useful fact about passwords.
Avoiding lookalikes
Option
Avoid 0/O and 1/l/I
Result
Alphabet drops from 76 to 71
A small entropy cost, about 0.1 bits per character. Worth paying when the password will be read off paper and typed.
Frequently asked questions
Is the password sent anywhere?
No. It is generated by your browser's crypto.getRandomValues and never leaves the page. No network request is made at any point. You can confirm that by opening the network tab and generating one.
How long should a password be?
Sixteen characters or more for anything that matters, and let a password manager remember it. Below about 12 characters even a full alphabet falls short of 80 bits. The practical answer is that length is free when you are not typing it from memory.
Why show entropy instead of a strength bar?
Because a strength bar is a guess dressed as a measurement. Entropy in bits is a real quantity: 60 bits means 2^60 possibilities. It also makes the trade-offs visible. You can see that four extra characters beat an extra character set.
Should I include symbols?
They add about 0.7 bits per character over letters and digits alone, which is real but modest. The bigger consideration is practical: some systems reject certain symbols or silently truncate. If a password is being typed on a phone keyboard regularly, extra length is easier than symbols.
What about passphrases instead?
Four random words from a large list gives roughly 50 to 65 bits and is far easier to type and remember, genuinely better for the handful of passwords you must memorise, such as your password manager's. For everything else, a generated string in a manager is stronger and you never type it.