Password Generator

Why length beats complexity

A password is only as strong as the number of guesses an attacker needs. Every extra character multiplies that number by the size of the character pool, while every extra rule (one capital, one symbol) adds only a little. Sixteen random lowercase letters are far harder to crack than eight characters drawn from every set, because 26 to the power of 16 dwarfs 90 to the power of 8. That is what the entropy figure measures: the bits of pure randomness in the result, computed as length times log2 of the pool size. Passphrases apply the same idea with words instead of characters and are much easier to type on a phone. Every character comes from crypto.getRandomValues, and out-of-range values are discarded rather than reduced with a modulo, so each character is chosen uniformly.

How to read the strength label

• Below 50 bits is weak: fine for a throwaway account, not for anything that matters.
• 50–70 bits is fair, 70–100 bits is strong, and anything above 100 bits is very strong against offline cracking for the foreseeable future.
• Excluding ambiguous characters helps when you have to read a password aloud or type it from paper; it costs only a fraction of a bit per character.
• Use a password manager so every account gets its own long random password, and keep passphrases for the few you must remember.

Privacy

Passwords are generated on your device with the browser’s cryptographic random source. Nothing is sent to a server, written to storage or logged, and the page works offline once loaded.