How the Passwords Are Made
Set a length between 4 and 64 characters, toggle any combination of uppercase, lowercase, numbers and symbols, and hit Generate. Randomness comes from your browser's Web Crypto API (crypto.getRandomValues) — the same cryptographically secure generator used for encryption keys — not the predictable Math.random(). With all four sets enabled the pool is 88 distinct characters, and every position is drawn independently, so nothing about one character hints at the next.
Why Length Beats Cleverness
Each character from an 88-symbol pool adds about 6.5 bits of entropy, and every bit doubles the guessing work. Assuming an attacker testing 10 billion guesses per second offline:
| Length | Entropy | Average time to crack |
|---|---|---|
| 8 characters | ~52 bits | days |
| 12 characters | ~77 bits | hundreds of thousands of years |
| 16 characters | ~103 bits | trillions of years |
| 20 characters (default) | ~129 bits | effectively forever |
The jump from 8 to 12 characters is the difference between "crackable this week" and "outlives the universe" — which is exactly what the strength meter below the output reflects: it steps from Weak below 8 characters through Fair and Good up to Strong at 16+.
Worked Example: Picking Settings
Say a legacy banking site rejects symbols. Untick symbols, leaving a 62-character pool (26 + 26 + 10), and compensate with length: at ~5.95 bits per character, a 22-character letters-and-digits password (~131 bits) is actually stronger than a 20-character password using all four sets (~129 bits). Rule of thumb: whenever a site restricts your character set, add a few characters of length and you've more than made up the difference.
Using Generated Passwords Well
- One password per site. Reuse, not weakness, is how most accounts fall — one breached site unlocks all the others.
- Store them in a password manager. A 20-character random string is not meant to be memorized; it's meant to be pasted.
- Regenerate freely. Clicking Generate again costs nothing; if a password was displayed somewhere semi-public, make a fresh one.
- Add a second factor where offered — even a perfect password can be phished.
Privacy
Generation runs entirely in your browser — nothing is sent to a server, nothing is stored, and closing the tab destroys the password unless you saved it. If you need related credentials, the UUID generator creates random identifiers and the hash generator computes SHA-256 checksums, both equally local.