Password Generators
Passwords people invent themselves follow patterns, and those patterns are exactly what cracking software tries first: a name, a date, a capital at the front and a digit at the end. A generated password has no such structure, which is why security guidance recommends one for any account that matters. The Password Generator builds a random string to your specification. You set the length and choose which character types to include, typically uppercase and lowercase letters, digits and symbols, then copy the result straight into the sign-up or password change form. Length does more for strength than complexity does, so if a site allows it, prefer a longer password over a short one stuffed with punctuation. Sixteen characters or more is a reasonable floor for email, banking and anything holding payment details. Generate a separate password for every account rather than adapting one across several. That way a breach at one site cannot be reused elsewhere, which is how most account takeovers actually happen. Since random strings are not memorable by design, store them in a password manager or, for the handful you must type from memory, use a long passphrase instead. The generator runs in your browser, so the password is created on your own device and never sent anywhere.
1 tools available
Showing 1–1 of 1
How the generator builds each password
Characters are drawn with a cryptographically secure random integer function, not a general-purpose pseudo-random shuffle, so the output is not reproducible from a seed or a timestamp. To guarantee that a password satisfies composition rules, the generator reserves one character from each enabled set, fills the remaining positions from the full pool, merges the two lists, shuffles the whole thing and trims it to your requested length. That ordering matters: without the final shuffle the guaranteed characters would always appear at the start, which is exactly the kind of structure an attacker can exploit.
Worked example: entropy of a 16-character password
Password strength is measured in bits of entropy, calculated as length multiplied by the base-2 logarithm of the alphabet size. Here log2(88) is about 6.46, so entropy is 16 x 6.46, or roughly 103 bits. That corresponds to about 2^103 possible passwords, a search space far beyond brute force with current hardware.
Compare that with a 16-character password using lowercase letters only. The alphabet drops to 26, log2(26) is about 4.70, and entropy falls to 16 x 4.70, or roughly 75 bits. Still strong, but eight characters' worth of protection has been given away.
Now compare an 8-character password with all four sets enabled: 8 x 6.46 is about 52 bits, which offline cracking hardware can work through. The lesson is that length buys more security than complexity: going from 8 to 16 characters doubles the entropy, while adding symbols to a short password adds only a few bits.
Choosing settings and using the result safely
The exclusion box is genuinely useful when a password will be read aloud, typed on a games console, or dictated over the phone. Excluding O, 0, l, 1 and I removes the common misreadings, though it does slightly reduce the alphabet and so the entropy. Add a character or two of length to compensate.
Treat the strength label as a rough guide rather than a verdict: it scores length thresholds and the number of character sets in use, and cannot know whether you will reuse the password elsewhere. Reuse, not composition, is what turns one breached site into several compromised accounts. Store the result in a password manager rather than a note or spreadsheet, and never reuse a generated password across services.