A password is only as strong as its randomness and its length, and those two factors interact multiplicatively rather than by simple addition. Adding one more character class barely helps a short password, while adding several more characters to the length helps enormously, because entropy grows with every additional character in the pool raised to the power of the password length, not with the size of the character pool alone.
What actually makes a password strong
Strength comes down to how many guesses an attacker would need before finding the right password, assuming they know everything about how it was generated except the password itself, which is the standard assumption in cryptography known as Kerckhoffs's principle. That number of guesses is determined entirely by the size of the character pool and the length of the password, expressed as entropy in bits, where each additional bit doubles the number of guesses required.
This is why a longer password beats a shorter one stuffed with symbols almost every time. A 20 character password using only lowercase letters has roughly 94 bits of entropy, comfortably beating a 10 character password that uses every available character class, which lands around 65 bits. Length is the lever that matters most, and this password generator's length slider reflects that directly in the entropy number shown alongside it.
- Prefer a longer password over a shorter one with more symbol variety when you have to choose.
- Sixteen characters or more is a reasonable minimum for anything protected by a password manager.
- Excluding ambiguous characters trades a small amount of entropy for fewer transcription mistakes.
- A unique password per account matters as much as password strength itself, since reuse defeats strength entirely.
Character classes and the excluded ambiguous characters option
Toggle uppercase letters, lowercase letters, digits and symbols independently to match a target system's password rules, which unfortunately still vary wildly across services. Each enabled class expands the pool of characters every position in the password is drawn from, which raises entropy, though as explained above, length still matters more than class count.
The exclude ambiguous characters option removes letters and digits that are easy to confuse when read aloud or typed by hand, such as the digit zero next to the uppercase letter O, the digit one next to the lowercase letter l and the uppercase letter I, in fonts where they look nearly identical. This is a genuine tradeoff: it slightly shrinks the character pool and therefore slightly reduces entropy for a given length, but it noticeably cuts down on transcription errors for a password you may need to type by hand rather than paste from a manager.
How this password entropy calculator actually works
Entropy in bits is calculated as the password length multiplied by the base 2 logarithm of the size of the character pool currently in use. A 12 character password drawn from a 26 character lowercase only pool has an entropy of 12 times log base 2 of 26, which comes out to roughly 56 bits. Enabling uppercase, digits and symbols on the same 12 character password grows the pool to around 94 characters and the entropy to roughly 79 bits, without touching length at all.
The strength verdict shown alongside the password is derived directly from that entropy figure using thresholds commonly cited in password guidance: below 40 bits is weak enough to fall to an offline attack quickly, 40 to 60 bits is fair but not future proof, 60 to 80 bits is strong for most purposes, and above 80 bits is comfortably strong against any realistic offline cracking attempt with current hardware.
How this password generator works under the hood
Every character is chosen using crypto.getRandomValues, part of the Web Crypto API, which pulls from your operating system's cryptographically secure random number generator. This tool never uses Math.random anywhere in the generation path, because Math.random is explicitly not designed for security purposes and its output is not guaranteed to be unpredictable across browser implementations.
Selection is also done carefully to avoid modulo bias, a subtle flaw where naively taking a random byte modulo the pool size makes some characters very slightly more likely than others. This tool rejects and redraws any random byte that would introduce that bias, so every character in the pool has exactly equal probability of appearing at any position, matching the entropy calculation exactly rather than approximating it.
| Length | Lowercase only | All classes |
|---|---|---|
| 8 characters | 38 bits | 52 bits |
| 12 characters | 56 bits | 79 bits |
| 16 characters | 75 bits | 105 bits |
| 20 characters | 94 bits | 131 bits |
How to generate a strong password
- 1
Set the length
Longer passwords add more entropy than extra character classes, so favour length when you can.
- 2
Choose character classes
Toggle uppercase, lowercase, digits and symbols to match the target system's password rules.
- 3
Exclude ambiguous characters if needed
Turn this on for a password you might need to type by hand rather than paste from a manager.
- 4
Check the entropy and verdict
Confirm the entropy in bits and strength verdict meet what the account or system requires.
Related tools worth bookmarking
Sources and further reading
- MDN: Crypto.getRandomValuesThe browser API this tool uses for every random character, instead of the insecure Math.random.developer.mozilla.org
- NIST SP 800-63B: Digital Identity GuidelinesThe authoritative federal guidance on password length, complexity and authenticator strength.pages.nist.gov
- OWASP Cheat Sheet SeriesPractical, widely followed guidance on authentication and password storage best practices.owasp.org
Frequently asked questions
Common questions about the password generator.
Yes. Every character comes from crypto.getRandomValues, the Web Crypto API's cryptographically secure random source, never from Math.random. Selection avoids modulo bias so every allowed character has exactly equal probability of appearing, and nothing about the generated password is transmitted anywhere.
Entropy equals the password length multiplied by the base 2 logarithm of the number of distinct characters available across the enabled character classes. A longer password or a larger character pool both raise this number, but length has a larger effect for the same relative increase, which is why length matters more than adding one extra character class.
Length, in almost every case. A 20 character password using only lowercase letters typically has more entropy than a 10 character password using every available character class. If a system allows it, choose a longer password before adding more symbol variety.
It removes characters that are commonly confused when read or typed, such as the digit zero and the uppercase letter O, or the digit one, the lowercase letter l and the uppercase letter I. This slightly reduces the character pool and therefore entropy for a given length, in exchange for fewer transcription mistakes.
Yes. Since the password never needs to be typed by hand when it lives in a manager, you can safely maximise both length and character variety without worrying about transcription errors, which produces the highest entropy result this tool can generate for a given length.
No. Generation happens entirely inside your browser using the Web Crypto API, with no network request involved at any point. You can confirm this by checking your browser's developer tools network panel while generating a password.