Password Generator

About the Password Generator

This password generator builds random passwords to whatever shape you need: pick a length between 6 and 64 characters, choose which of the four character sets to draw from, and produce up to twenty candidates at once. Alongside the list you get an entropy figure in bits, the size of the character pool and a plain verdict on whether the result clears the roughly 60 bits usually recommended for an account login. Everything runs inside your browser tab. Nothing is transmitted, and because the generator is seeded rather than cryptographic, the same seed always reproduces the same batch.

How to use the Password Generator

1. 1

   Drag the Length slider to the number of characters you want, anywhere from 6 up to 64.

2. 2

   Set How many to decide how many candidates appear in the list, up to twenty.

3. 3

   Tick the character sets you need — Uppercase, Lowercase, Numbers, Symbols — and enable Exclude ambiguous characters if the password will be read aloud or typed from paper.

4. 4

   Press Generate, then read the Strength panel to see the entropy in bits before you copy or download the list.

What people use it for

What entropy in bits actually measures

Entropy is calculated as length multiplied by the base-2 logarithm of the pool size. With all four sets enabled the pool is 87 characters, so log2(87) is about 6.44 bits per character; sixteen characters therefore carry roughly 103 bits. Each bit doubles the number of guesses an attacker must make, so 103 bits means around 2^103 possible passwords. The figure describes the generator, not the string: a password that happens to spell a dictionary word still has the full entropy of the process that produced it, because an attacker who does not know your settings gains nothing from the coincidence. The threshold that matters in practice is around 60 bits for an ordinary account, which rate limiting and slow password hashing already put out of reach, and 80 or more where an attacker might get hold of a stolen hash and grind it offline.

Why length beats complexity

Adding a character multiplies the search space by the whole pool size; adding a character set only widens the pool a little. Moving from a 62-character alphanumeric pool to an 87-character pool with symbols gains about 0.49 bits per character, whereas one extra character gains a full 5.95 bits. That is why an eight-character password stuffed with substitutions loses badly to a plain twenty-character passphrase, and why the NIST SP 800-63B guidance dropped mandatory complexity rules in favour of a minimum length and a check against known breach lists. Forced complexity carries a behavioural cost too: people respond to it with predictable habits such as capitalising the first letter and appending a digit and an exclamation mark, and cracking tools model those habits directly.

The honest limits of this generator

The random numbers here come from mulberry32, a small seeded pseudo-random function, not from the operating system's cryptographic entropy source. That is a deliberate design choice: it keeps the tool a pure function so the same inputs always give the same outputs, which is what makes seeds and reproducible test data possible. The consequence is that anyone who knows your seed and settings can regenerate your password exactly. For everyday accounts, where the seed is never published, this is not a practical risk. For anything genuinely high-value — a password manager master password, an encryption key, a root credential — use the generator built into your password manager or a command line tool backed by crypto.getRandomValues, which draws on the kernel entropy pool and cannot be replayed.