Password Generator

This password generator produces random strings using a cryptographically secure random number source rather than a predictable shuffle. You set the length anywhere between 4 and 128 characters and switch four character sets on or off: uppercase letters, lowercase letters, digits, and the symbol set !@#$%^&*()_+-=[]{}|;:,.<>?. An exclusion box lets you strip out characters you find hard to read or that break a particular system, and you can ask for up to 20 passwords in a single run so a whole set of accounts or service credentials can be created at once. Each password is guaranteed to contain at least one character from every set you enabled, then shuffled so the required characters do not sit in a predictable position. A strength label is shown alongside the result, based on the length and the number of character sets in use.

The tool first assembles an alphabet from the sets you enabled. Uppercase adds 26 letters, lowercase another 26, digits add 10, and the symbol option adds 26 punctuation characters, giving a maximum pool of 88 distinct characters. Anything you type into the exclusion box is then removed from that pool, so barring characters such as the letter l, capital I and the digit 1 shrinks the alphabet before generation begins.

Characters are drawn with a cryptographically secure random integer function, not a general-purpose pseudo-random shuffle, so the output is not reproducible from a seed or a timestamp. To guarantee that a password satisfies composition rules, the generator reserves one character from each enabled set, fills the remaining positions from the full pool, merges the two lists, shuffles the whole thing and trims it to your requested length. That ordering matters: without the final shuffle the guaranteed characters would always appear at the start, which is exactly the kind of structure an attacker can exploit.

Set the length to 16 and enable all four character sets. The alphabet is 26 + 26 + 10 + 26 = 88 possible characters per position.

Password strength is measured in bits of entropy, calculated as length multiplied by the base-2 logarithm of the alphabet size. Here log2(88) is about 6.46, so entropy is 16 x 6.46, or roughly 103 bits. That corresponds to about 2^103 possible passwords, a search space far beyond brute force with current hardware.

Compare that with a 16-character password using lowercase letters only. The alphabet drops to 26, log2(26) is about 4.70, and entropy falls to 16 x 4.70, or roughly 75 bits. Still strong, but eight characters' worth of protection has been given away.

Now compare an 8-character password with all four sets enabled: 8 x 6.46 is about 52 bits, which offline cracking hardware can work through. The lesson is that length buys more security than complexity: going from 8 to 16 characters doubles the entropy, while adding symbols to a short password adds only a few bits.

For everyday accounts, 16 characters with letters, digits and symbols is a sensible default. For anything protecting other credentials, such as a password manager master password or a root account, go to 24 characters or more. If a site rejects the password, the cause is almost always a symbol it refuses; switch symbols off and add four characters instead, which keeps the entropy roughly the same.

The exclusion box is genuinely useful when a password will be read aloud, typed on a games console, or dictated over the phone. Excluding O, 0, l, 1 and I removes the common misreadings, though it does slightly reduce the alphabet and so the entropy. Add a character or two of length to compensate.

Treat the strength label as a rough guide rather than a verdict: it scores length thresholds and the number of character sets in use, and cannot know whether you will reuse the password elsewhere. Reuse, not composition, is what turns one breached site into several compromised accounts. Store the result in a password manager rather than a note or spreadsheet, and never reuse a generated password across services.