Strong Password Generator

Where the randomness comes from

Every password is drawn from crypto.getRandomValues, the browser's cryptographically secure generator. Math.random() is never used — it is predictable enough to reconstruct, which makes a password generated from it worse than useless, because it still looks safe.

Selection also uses rejection sampling rather than a plain modulo. Taking random % 26 makes the first few letters of the alphabet slightly more likely, and that bias is measurable across a batch.

Every selected set is guaranteed

The generator places one character from each set you enable before filling the rest at random, then shuffles. Without that step a 12-character password with digits enabled can legitimately contain none, and sites that demand a digit will reject it.

Reading the strength meter

Entropy is estimated as length × log₂(pool size) — the number of bits an attacker would have to guess:

• Under 45 bits — weak; fine for throwaway accounts only
• 45–65 bits — fair
• 65–90 bits — strong; a sensible default for real accounts
• Over 90 bits — excellent, and beyond brute force with current hardware

Length matters more than complexity: a 20-character lowercase password beats a 10-character one using every symbol on the keyboard.

Nothing leaves your device

Passwords are generated in your browser and never transmitted, logged or stored. Reload the page and they are gone — copy what you need into a password manager first.