Overview
Most password advice fails at the first step: it asks humans to invent randomness, which humans are bad at. We reach for familiar words, predictable substitutions and keyboard walks, and attackers have dictionaries for all of them. The reliable fix is to stop inventing and start generating — let software draw each character from a properly random source so no habit or memory can leak into the result.
This generator does exactly that, and it shows its work. Drag the length slider anywhere between 4 and 128 characters, switch the four character families on or off, and filter out look-alike characters when the password might be typed by hand. The entropy meter recalculates with every change, so instead of trusting that a password looks strong, you can read the number.
What does the entropy meter actually measure?
Entropy, measured in bits, is the honest size of the guessing game. If a password could be any of N equally likely combinations, its entropy is log2(N). Sixteen characters drawn at random from about eighty symbols gives roughly 101 bits — meaning an attacker would need on the order of 2^101 guesses. That number is what the meter shows, live, as you adjust the settings.
The meter rewards length far more than decoration, because each added character multiplies the search space. As a rough guide: under 40 bits is weak, 40-60 bits is fair for throwaway accounts, 60-80 bits is strong for everyday logins, and beyond 80 bits you are in very-strong territory. The meter turns those bands into a reading you can act on.
Features
- Length from 4 to 128 characters, set with a slider or an exact number — the two stay in sync.
- Four independent character families — uppercase, lowercase, digits and symbols — each with its own toggle.
- Look-alike filter that strips 0, O, 1, l, I and the pipe character for passwords read aloud or from paper.
- Guaranteed family coverage: every enabled family appears at least once, placed at a random position.
- Live entropy meter translating your settings into bits of strength as you adjust.
- One-click copy and regenerate for fast rotation across accounts.
- Cryptographic randomness from your browser's secure random source — never Math.random.
Benefits
- No more reused passwords. Generating is fast enough to give every account its own secret.
- Composition rules handled. Coverage guarantees mean “must include a symbol” forms accept it first time.
- Strength you can verify. The entropy reading replaces guesswork with a number.
- Zero trust required. Nothing leaves the page, so there is nothing to intercept.
Who can use it
Anyone with an online account — which is everyone. It is especially useful when signing up for a new service, rotating a password after a breach notice, or creating credentials for shared team tools. Developers generating API keys and database passwords get the same benefit at larger lengths. If you use a password manager, this is the engine that fills it; if you do not, it is the reason to start.
How to use
- Drag the length slider (or type an exact number) to set the password length.
- Toggle the character families you want — capitals, small letters, digits, symbols.
- Switch on the look-alike filter if the password will ever be typed by hand.
- Check the entropy meter, then press regenerate until you like the look of it.
- Copy the password and store it in a password manager — not in your head.
Frequently asked questions
How long should my password be?
Sixteen characters from the full set is a solid default for important accounts — around 100 bits of entropy, far beyond brute force. For casual accounts, twelve is usually fine. The real rule is length first: a twenty-character all-lowercase password quietly beats a twelve-character jumble of symbols. Use the meter and aim above 60 bits for anything that matters.
Are generated passwords truly random?
They are drawn from your browser's cryptographic random number generator, the same source used for TLS keys — designed to be unpredictable even to someone watching the system closely. That is a different league from the basic random functions in most programming languages, which must never be used for secrets.
Should I memorise the password it makes?
No — that defeats the purpose. Generated passwords are meant to be stored in a password manager and pasted when needed. Your memory should hold exactly one strong secret: the master password (or passphrase) that unlocks the manager. Everything else can be gloriously unmemorable.
What does the look-alike filter remove?
Characters that are easy to confuse when read or typed: zero and capital O, one and lowercase L, capital I, and the pipe symbol. Switch it on whenever a password might be dictated over the phone, copied from a printout, or typed on an unfamiliar keyboard — it costs a little entropy and saves a lot of frustration.
Can the site see the passwords it generates?
No. Generation happens entirely in your browser's memory; the characters are never sent to any server, written to any log, or stored anywhere. Close the tab and the password exists only wherever you saved it.
Why does it guarantee each character family appears?
Because many sites enforce composition rules — “must contain a digit and a symbol” — and a purely random draw might miss one, forcing you to regenerate. By placing one character from each enabled family at a random position first, the password passes those checks on the first try without weakening the randomness.
Conclusion
Strong passwords are not invented; they are generated, measured and stored. Set the length, check the meter, copy the result into a manager — and never reuse a password again.