Secure Password Generator

Password strength is a search problem before it is a punctuation problem. A random 16-character password resists guessing because every position is selected from a known set of possible characters with no human pattern behind it. Attackers do not need the password to look simple. They only need the candidate list to be small enough, patterned enough, or reused enough to search successfully.

Length usually expands the search space more than any single symbol. Adding punctuation helps when the destination accepts it and the symbol set genuinely widens the pool, but a short familiar word with a symbol at the end is still a familiar shape. A longer random password that is never reused often beats a shorter password forced through a checklist of uppercase letters, digits, and special characters.

Compatibility still matters. A banking form may reject certain punctuation, an old device may accept only digits, a recovery workflow may require manual typing, and a password manager can store a long mixed string that nobody needs to memorize. The safer usable password is random, unique to one account, accepted without weakening edits, and stored where it will not be copied into notes, tickets, or shared messages.

Modern password guidance has moved away from arbitrary composition rules as the main measure of strength. For user-chosen passwords, verifiers are encouraged to allow long passwords, avoid silent truncation, check against common or compromised values, support password managers, and use multi-factor authentication for important accounts. Random generated passwords fit that model best when each account receives its own password and the final value is stored in a password manager.

A generated password does not solve every account risk. It can still be phished, copied from clipboard history, captured by malware, exposed in an export, or reused after a breach. Treat the generated string as a live credential from the moment it appears, and use the strength numbers as a guide to guessing resistance rather than as a complete security guarantee.

How to Use This Tool:

Pick the password shape the destination will accept, generate a candidate, then read the security and compatibility cues before copying it.

1. Choose a Preset. Strong creates a 16-character mixed password, Long creates a 24-character password without symbols, PIN creates six digits, and Custom leaves the current settings editable.
2. Set Length from 4 to 128 characters. When the destination allows it, increasing length is usually the most direct way to raise entropy.
3. Turn uppercase, lowercase, numbers, and symbols on or off to match the rules of the account, device, vault, or legacy form that will receive the password.
4. Open Advanced for transcription and policy constraints: remove ambiguous characters, require each enabled type, prevent repeated characters, add approved extra characters, or block characters the destination refuses.
5. Press Generate when you want another draw with the same settings. Changing a setting also generates a fresh candidate after the new pool is valid.
6. If an error appears, the chosen constraints cannot produce a password. Enable at least one character source, increase length for required types, shorten a unique-only request, or relax exclusions.
7. Use Password Details, Password History, Entropy Trends, and JSON to compare the candidate, copy rows, or export a summary. Remove exported files after use if they contain live credentials.

Interpreting Results:

The summary gives the generated password, a show/hide control, copy action, strength label, entropy estimate, active pool size, length, and a crack-time benchmark. These values answer different questions. Entropy describes the formula-based search space, the crack-time estimate applies one fixed guessing speed, and the zxcvbn label looks for patterns that the formula may miss.

A large entropy number is useful only when the password is random, unique, and accepted without weakening edits. A good zxcvbn label is useful as a pattern check, not as proof that storage, multi-factor protection, or phishing defenses are sound. Read the values together, especially when a password must satisfy a restrictive site policy.

The history list is for comparison during the current page session. Do not keep several generated passwords around longer than needed, and do not paste exported CSV, DOCX, or JSON summaries into shared tickets or messages when they include the actual password.

Technical Details:

Random password strength starts with the character pool. The pool is built from the enabled uppercase, lowercase, digit, symbol, and extra-character sources, then filtered by the ambiguous-character and excluded-character rules. Duplicate extra characters collapse to one usable character, so repeating the same approved symbol several times does not increase the search space.

Each password position is selected from the active pool. The generator uses the browser's cryptographic random source when available and falls back to weaker pseudo-random selection only when that source is missing. The password is scored after generation, so the displayed strength label reflects the actual candidate rather than only the settings that produced it.

Formula Core:

If a password has L positions and each position is drawn from N possible characters, the ideal search space is N^L. Entropy converts that search space to bits, and the crack-time benchmark divides the same space by 10 billion guesses per second.

Here H is entropy in bits, C is the number of combinations, and t_sec is seconds at the fixed benchmark speed. With lookalikes removed, the Strong preset uses 88 active characters for 16 positions, which is about 103.4 bits. The Long preset uses 56 active characters for 24 positions, which is about 139.4 bits. A six-digit PIN has only 10 active characters for 6 positions, or about 19.9 bits, so it depends heavily on rate limits and device lockout.

Character Pool Rules:

Validation Bounds:

Privacy and Safety Notes:

Generation, scoring, history, charts, and exports run in the browser after the page has loaded. The generated password does not need a tool-specific server lookup, but the credential can leave your control if you copy it into a shared clipboard, download a report, sync it to an unsafe location, or paste it into the wrong account.

• Use a different generated password for every account.
• Store the final password in a password manager, not in screenshots, chat messages, notes, or exported reports.
• Use multi-factor authentication for important accounts because password strength does not stop phishing or malware.
• Do not treat the zxcvbn label as a breach check. It estimates guessability patterns; it does not query a live compromised-password database.
• Delete CSV, DOCX, JSON, and chart files that reveal or describe a live password after they have served their purpose.

Worked Examples:

FAQ:

Glossary:

Active pool size

The number of distinct characters available after enabled sets, extra characters, lookalike removal, and exclusions are combined.

Entropy

A bit estimate based on password length and active pool size under an independent random-draw model.

Lookalikes

Characters such as 0, o, O, 1, l, and I that can be removed to reduce reading and typing mistakes.

zxcvbn score

A 0 to 4 pattern-aware strength score shown as Very Weak, Weak, Fair, Good, or Strong.

Crack-time benchmark

The displayed estimate produced by dividing the formula-based combination space by 10 billion guesses per second.

References:

• NIST SP 800-63B: Authentication and Authenticator Management.
• OWASP Authentication Cheat Sheet.
• MDN Web Docs: Crypto.getRandomValues().
• Dropbox zxcvbn password strength estimator.
• How to generate a random password using OpenSSL, Simplified Guide.