What makes a password secure?
A password's resistance to a brute-force attack depends almost entirely on two factors: how many distinct symbols each position can hold (the size of the "alphabet") and how many positions it has in total (the length). Together they determine entropy, measured in bits, which indicates how many possible combinations exist: each additional bit doubles that number.
An 8-character password using only lowercase letters has a 26-symbol alphabet and an entropy of 8 × log₂(26) ≈ 37.6 bits — around 200 billion combinations, which a modern GPU can try in a matter of hours. The same length combining lowercase, uppercase, numbers, and symbols (an alphabet of nearly 94 symbols) climbs to 8 × log₂(94) ≈ 52.4 bits, thousands of times more combinations. But making the password longer is almost always more effective than expanding the alphabet: going from 8 to 16 characters using only lowercase letters already gives 16 × log₂(26) ≈ 75.2 bits, more resistant than combining every character type in 8 positions.
Why randomness matters as much as length
All this entropy math assumes each character was chosen truly at random from the entire available alphabet. If instead it follows a predictable pattern (a dictionary word, a date, swapping letters for similar-looking symbols like @ for a), the real space of combinations an attacker needs to try shrinks drastically, no matter how many bits the password has "in theory." Dictionary attacks and leaked password lists exploit exactly this gap between theoretical and real entropy.
That's why this tool doesn't build passwords out of words or patterns: it picks each character independently and uniformly from the selected alphabet.
Why crypto.getRandomValues and not Math.random()
Math.random() in JavaScript is meant for general-purpose use (animations, sampling, games), not cryptography: its internal algorithm (typically a xorshift-style PRNG) can have its internal state reconstructed from a handful of generated values, which in theory would allow predicting future output. Generating passwords, keys, or tokens requires a cryptographically secure generator, whose output is computationally impossible to distinguish from true randomness.
crypto.getRandomValues, part of the Web Crypto API available in every modern browser, is designed exactly for this: it draws its entropy from the operating system's own random number generator. This tool uses that function exclusively — never Math.random() — to pick every character in the generated password.
Ambiguous characters
Some symbols are easy to mix up depending on the typeface: the digit zero (0) and the uppercase letter O, or the digit one (1), lowercase L (l), and uppercase I (I). If the password needs to be transcribed by hand (read off a screen and typed into another device, for example), excluding these ambiguous characters reduces transcription errors at the cost of a small amount of entropy.
How to use this tool
Choose the desired length and which character types to include (lowercase, uppercase, numbers, symbols), with the option to exclude ambiguous characters if needed. The password is generated instantly using crypto.getRandomValues, and the strength meter shows the resulting entropy in bits along with a classification (weak, fair, strong, very strong). All computation happens in the browser: the generated password is never sent to any server or logged in the URL, unlike other tools on this site meant for sharing results.