What makes a password strong?
Password strength comes from two factors: length and character diversity. A longer password from a larger character set requires more guesses to crack. The mathematical measure is entropy — the number of bits needed to represent all possible passwords of that length and character set. Every bit of entropy doubles the number of possible values an attacker must search through.
An 8-character password using only lowercase letters has 26^8 ≈ 200 billion possibilities. Expand to mixed case plus digits plus symbols (roughly 90 characters) and the same 8 characters gives 90^8 ≈ 43 quadrillion possibilities — 200,000 times harder to crack. Add 4 more characters to get 12-character length and you reach 90^12 ≈ 282 septillion possibilities. Modern GPU cracking rigs can test around 10 billion guesses per second — a 12-character mixed password would take millions of years to brute-force.
How the generator creates random passwords
The generator uses window.crypto.getRandomValues() — the browser's cryptographically secure random number generator (CSPRNG). This is the same quality of randomness used in professional security tools and is specified in the Web Cryptography API. It is fundamentally different from Math.random(), which is a pseudo-random number generator not suitable for security applications.
For each character position, the generator selects a random byte and maps it to a character in the allowed character set using rejection sampling — discarding values that would introduce bias when the charset size is not a power of 2. The result is that every character in the allowed set has an exactly equal probability of appearing in every position.
Character type options
Uppercase (A–Z) adds 26 characters to the pool. Lowercase (a–z) adds 26 more. Numbers (0–9) add 10. Symbols add approximately 32 more, depending on which set is included. Including all four types gives a character space of about 90–95 characters, which maximises entropy per character. The strength meter updates in real time as you toggle options, showing you exactly how much entropy each choice adds.
Excluding ambiguous characters
Characters like 0 (zero), O (capital O), 1 (one), l (lowercase L), and I (capital i) are visually very similar in many fonts and can be confused when reading a password aloud or transcribing it from one place to another. Enabling "exclude ambiguous" removes these characters from the pool. This slightly reduces entropy but prevents the most common transcription errors. Only enable this option if you will ever need to type the password from memory or read it aloud — for passwords stored in a password manager, leave ambiguous characters enabled.
The colour coding
The generated password display uses colour to show the character types at a glance: purple for uppercase, green for lowercase, orange for numbers, and pink for symbols. This helps you verify at a glance that the password includes the character types you requested, and see the distribution. A good password should have a fairly even mix of colours.
Length recommendations
For accounts protected by a password manager (you never type the password): 20–32 characters with all character types. For passwords you must type occasionally (computer login, password manager master password): 16 characters minimum. For any online account: never under 12 characters. For WiFi passwords (typed once): 16–20 characters, optionally excluding ambiguous characters for easier transcription.