Length beats complexity, and it is not close. A 16-character password drawn from lowercase letters alone carries about 75 bits of entropy, while a 6-character one using every category on this page carries 39. The Password Generator lets you set both, but the slider is the control that matters.
Every character comes from the browser's cryptographic random source. That is not a detail: a generator built on ordinary pseudo-random numbers produces output that is reproducible from its seed, which is a catastrophic property for a password and an invisible one.
Ticking a category is treated as a promise rather than a suggestion. One character from each checked set is placed first and the remainder drawn from the combined pool, then the whole string is shuffled so those guaranteed characters do not sit predictably at the front. Nothing is transmitted and nothing is stored, so closing the tab is the end of it.
Options and What They Guarantee
- The 4 categories contribute 26 uppercase letters, 26 lowercase, 10 digits and 26 symbols, giving a maximum pool of 88 characters.
- The symbol set is
!@#$%^&*()-_=+[]|;:,.<>?. Some legacy systems reject several of these, which is worth checking before you commit a password you cannot retype. - Unticking the last remaining category does nothing. The change is refused outright rather than quietly generating a lowercase-only password behind your back.
- Password Length runs from 6 to 64 and starts at 16. Moving the slider regenerates immediately, as does toggling any category, so there is no stale password on screen.
- The circular arrow beside Copy redraws with the same settings, which is the button to press when a generated password contains a character sequence you would rather not type.
How the Math Adds Up to Entropy
- Entropy is length multiplied by the base-2 logarithm of the pool size. With all 4 categories on, that is 6.46 bits per character.
- At the default 16 characters, the full pool gives 103 bits. Drop to 12 and it falls to 78. Push to the maximum of 64 and it reaches 413, which is far beyond any conceivable attack and a nuisance to type.
- Removing symbols costs less than shortening the password. A 16-character alphanumeric password holds 95 bits against 103 with symbols, so trading them for 2 extra characters comes out ahead.
- Roughly 80 bits is the practical threshold for a password guarded by a slow hash. That means about 13 characters from the full pool, and the default of 16 leaves comfortable margin.
- These figures assume the attacker knows your settings and only has to search the space, which is the right assumption. Secrecy of the character set is never part of the strength.
When Not to Use a Generated Password
- The strength meter is a rough heuristic, not an entropy calculation. It awards points for length past 12 and 16 and for the presence of a capital, a digit and a symbol, so a 6-character password using all 4 categories reads Good at 39 bits while a 16-character lowercase one reads Fair at 75. Trust the length.
- A password you have to memorise is better built from 5 or 6 random words. Random characters are for a password manager to hold, not for a human to remember.
- Nothing here is stored, which cuts both ways. Copy the password into your manager before you close the tab, because it cannot be recovered afterwards.
- Generate on the device that will use it. Reading a password aloud, photographing it or sending it through chat undoes the point of generating it well.
- For an encryption passphrase rather than a login, go longer than 16. Those are frequently attacked offline at billions of guesses per second, with no server rate limit in the way.