Password Generator Developer Tool

How this generator produces randomness

Every character or word this tool picks comes from crypto.getRandomValues(), the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG). This matters because JavaScript's Math.random(), which powers a lot of "password generators" found online, is not designed for security — its output is generated by a fast, non-cryptographic algorithm that can, in principle, be predicted if an attacker observes enough consecutive outputs. A CSPRNG is built specifically so that knowing past output gives no advantage in predicting future output. The generator also rejects biased values near the top of the random range before taking a modulo, so every character in a chosen set has an exactly equal chance of being picked — a detail that's easy to get subtly wrong and that skews real-world password strength if ignored.

Entropy and character sets

A password's strength against brute-force guessing is usually expressed in bits of entropy: length × log2(pool size), where the pool size is how many distinct characters could appear at each position. Adding a character type that was previously excluded (say, turning on digits when only letters were selected) increases the pool and therefore the entropy per character, but the effect is smaller than most people expect — going from a 26-character lowercase-only pool to a 62-character alphanumeric pool only takes you from about 4.7 to 5.95 bits per character. Adding two more characters of length has a bigger effect on total entropy than adding an entire new character class. This is why the length slider on this tool generally moves the strength meter more than any individual checkbox.

Passphrases vs. random character strings

The "Multiple words" mode implements a Diceware-style passphrase: several words chosen independently at random from a fixed list, rather than a sentence you make up yourself. A made-up phrase is a poor source of entropy because natural language is predictable — common phrases, quotes, and grammatical patterns dramatically shrink the real search space even though the string looks long. A passphrase built from independently and randomly selected words avoids that problem: with a 108-word list, four random words give roughly 4 × log2(108) ≈ 27 bits from word choice alone, comparable to a much shorter random character string, while remaining far easier to type and remember. Passphrases are a reasonable choice for passwords you'll type by hand often, such as a device unlock code or a password manager's master password; random character strings are better suited to accounts where a password manager stores and autofills the value, since there's no need to type or memorize it.

Why length matters more than complexity rules

Older password policies that mandated "at least one uppercase, one number, one symbol" were an attempt to increase entropy per character, but in practice they mostly push people toward predictable substitutions (password becomes P@ssw0rd1) that attackers' cracking dictionaries already account for. A longer password built from a larger genuinely random pool, or a longer passphrase, resists both dictionary attacks and brute-force attacks far more effectively than a short password stuffed with required character types. Every additional random character roughly doubles to quadruples the number of guesses an attacker needs (depending on pool size), which compounds quickly — the difference between a 10-character and a 16-character fully random password is the difference between hours and centuries against a fast offline attack.

Common password policy myths

A few widely held beliefs don't hold up well under scrutiny. Forced periodic password changes (e.g. "every 90 days") tend to produce weaker passwords over time, because people make small, predictable increments to their existing password rather than choosing a genuinely new one — both NIST and most current security guidance now recommend against mandatory expiry for this reason, favouring long, random, unique passwords changed only when there's reason to believe they've been compromised. Similarly, requiring a mix of character types without a strong length requirement gives a false sense of security, since the entropy gain from character variety is smaller than most policies assume. The most effective password policy, by a wide margin, is a long, randomly generated, unique password per account, stored in a password manager rather than memorized.