Randomness, entropy, and what actually makes a password strong
A password generator produces a string of characters drawn at random from a chosen alphabet, using a source of randomness that cannot be predicted from previous outputs.
Password strength is not a matter of looking complicated. P@ssw0rd! satisfies most complexity rules and is in every cracking dictionary ever assembled. Strength is measured in entropy — how many equally likely passwords the generator could have produced — and entropy comes from two things only: the size of the character set and the length.
This page gives the exact alphabet this generator uses, the entropy each setting produces, an honest note on the one small statistical imperfection in the implementation, and guidance on where generated passwords should actually live.
The generator, specified
- Randomness source
- The Web Crypto API’s cryptographically secure random number generator, seeded by the operating system. This is not Math.random(), whose output is predictable from prior values and unsuitable for secrets.
- Character sets
- 26 uppercase letters, 26 lowercase letters, 10 digits, and 26 symbols — the printable set !@#$%^&*()_+-=[]{}|;:,.<>? With all four enabled the alphabet is 88 characters.
- Length range
- Adjustable from 6 to 64 characters, defaulting to 16. Sixteen with all four sets enabled is roughly 103 bits of entropy.
- Where it runs
- Entirely in your browser. Generated passwords are never transmitted, logged or stored by this site — which is the only acceptable design for a tool of this kind.
- The strength meter
- A settings heuristic, not a crack-time estimate. It adds a point at length 12, another at 16, and one for each enabled character set, mapping 0–6 points onto Weak, Medium, Strong and Very Strong.
- A disclosed imperfection
- Characters are selected by reducing a 32-bit random value modulo the alphabet size. With 88 characters, 48 of them are more likely than the rest by about two parts in one hundred million — mathematically real, practically irrelevant, and stated here rather than glossed over.
How much entropy each setting actually gives you
Direct answer: entropy in bits is length multiplied by log₂(alphabet size). Each additional bit doubles the work an attacker must do.
| Settings | Alphabet | Length 12 | Length 16 | Length 20 |
|---|---|---|---|---|
| Lowercase only | 26 | 56 bits | 75 bits | 94 bits |
| Lowercase + digits | 36 | 62 bits | 83 bits | 103 bits |
| Upper + lower + digits | 62 | 71 bits | 95 bits | 119 bits |
| All four sets enabled | 88 | 78 bits | 103 bits | 129 bits |
For context: below about 60 bits is within reach of a well-funded offline attack against a fast hash. Around 80 bits is comfortable for most accounts. Above 100 bits, length has stopped being the weak link — reuse, phishing and the site’s own password storage are.
Five things people get wrong about password strength
Complexity rules do not create entropy
A rule demanding one uppercase, one digit and one symbol usually produces Password1! — predictable substitutions that cracking tools try first. Random generation with adequate length beats any complexity policy.
Length beats symbol variety
A 20-character lowercase-only password (94 bits) is stronger than a 12-character password using all 88 symbols (78 bits). If a site rejects symbols, add characters instead of arguing with it.
Reuse defeats everything
A 64-character password used on two sites is only as strong as the weaker site’s breach history. Credential-stuffing attacks are the most common way accounts fall, and no amount of entropy prevents them.
Rotation schedules do more harm than good
Forcing a change every 90 days pushes people towards predictable increments. Modern guidance from NIST recommends changing passwords when there is evidence of compromise, not on a calendar.
"Military-grade" means nothing
It is a marketing phrase, not a standard. What matters for a password is entropy at generation and how the receiving site hashes it — neither of which any generator can control.
Symbols can break automated systems
Some legacy forms, database connection strings and shell scripts mishandle quotes, backslashes or ampersands. For a service credential, turn symbols off and add length rather than debugging an escaping bug at 3am.
Recommended settings by use case
| Use | Suggested setting | Why |
|---|---|---|
| Everyday website account | 16 characters, all sets | About 103 bits — far beyond any realistic offline attack, and short enough for a manager to autofill anywhere. |
| Password manager master password | A passphrase you can actually remember | This is the one you must type from memory. Five or six random words from a large list are easier to recall and comfortably strong; a generated string you cannot remember gets written down. |
| API key, database or service credential | 32+ characters, letters and digits only | Long enough to be irrelevant to attackers, and free of characters that break connection strings and shell escaping. |
| Temporary credential handed to a client | 16 characters, all sets, forced change on first login | Assume it will travel over email or chat. Rotate it as soon as the handover is done. |
| Wi-Fi network password | 20+ characters, letters and digits | Typed once per device, often on a TV remote or phone keyboard. Length carries the strength; symbols only add pain. |
Handling a generated password safely
- Save it to a password manager before you navigate away — this page keeps no history and cannot recover it.
- Turn on two-factor authentication wherever it is offered. It defends the account even if the password leaks.
- Never send a credential over the same channel as the username. Split them across two channels if you must share one.
- For a shared workspace, use the team vault rather than a spreadsheet or a pinned chat message.
- Generate a new one per site; a manager makes the count irrelevant.
- Check that the destination site is served over a valid HTTPS connection before entering anything — the SSL certificate checker will confirm it.
How this page is maintained
The alphabet, the 6–64 length range, the randomness source and the strength-meter thresholds were read from this tool’s source. The entropy figures are calculated as length × log₂(alphabet size) and rounded to the nearest bit; the modulo-bias note reflects the actual selection method rather than an idealised description.
Written and reviewed by the ToolsRacks editorial team. Last reviewed: .