How This Password Generator Works
Choose a length and which character sets to include — lowercase, uppercase, digits, symbols — and the generator assembles a random password using your browser's cryptographic random source. Everything happens locally on your device: no password is generated on, sent to, or seen by any server.
The strength meter estimates cracking resistance from length and character variety — and the honest summary of password security is: length beats cleverness.
The Entropy Math: Why Length Wins
Password strength is measured in bits of entropy:
Pool sizes: lowercase 26 → +26 upper = 52 → +10 digits = 62 → +symbols ≈ 90. What that means against a modern offline attack (~10¹¹ guesses/second):
| Password | Entropy | Crack time (order of magnitude) |
|---|---|---|
| 8 chars, lowercase | 38 bits | seconds |
| 8 chars, all sets | 52 bits | hours |
| 12 chars, all sets | 78 bits | centuries |
| 16 chars, all sets | 104 bits | heat death of the universe territory |
| 20 chars, lowercase only | 94 bits | millions of years |
Note the last row: 20 plain lowercase letters beat 8 characters of everything. Each added character multiplies difficulty by the whole pool size — length compounds, complexity only adds.
What Actually Gets Passwords Cracked
Attackers don't iterate a–z blindly — they run dictionaries of leaked passwords, common substitutions (P@ssw0rd fools no software), keyboard walks (qwerty123), and personal data (names, birthdays, pets). Which yields the real rules:
- Random beats memorable-pattern — that's the entire value of a generator.
- Unique per site — reuse converts one breach into access everywhere ("credential stuffing"). This is the #1 practical risk.
- 12+ characters minimum, 16+ for anything important.
- No personal data, ever — it's the first thing tried.
Storing Them: The Manager Question
Random unique passwords are unmemorizable by design — the system only works with a password manager:
- One strong master passphrase protects an encrypted vault of everything else.
- Managers autofill only on matching domains — quietly defeating look-alike phishing sites.
- Browser-integrated managers are fine for most people; dedicated ones add cross-device features.
For the master passphrase itself, a diceware-style phrase (4–6 random words: "copper-mango-drizzle-vault") delivers high entropy while staying typeable and memorable.
Then enable two-factor authentication on email, banking, and anything critical — it converts a stolen password from a disaster into a nuisance. Your email account matters most of all: it's the reset key to everything else.
The Bottom Line
The recipe is boring and bulletproof: generate 16+ random characters per site, store them in a manager behind one strong passphrase, add 2FA on the accounts that matter. The generator above handles step one locally and instantly — the other two are this week's best security errand.