How strong are the generated passwords?

A 16-character password drawn from all four character sets carries about 105 bits of entropy, which is beyond the reach of practical offline cracking. The strength bar labels results as Weak, Fair, Good or Strong based on length and variety.

Is the random source cryptographically secure?

Yes. The generator uses crypto.getRandomValues with rejection sampling to produce uniformly random characters, the same quality of randomness browsers use for encryption keys.

Does the generator guarantee a mix of character types?

When the selected sets allow it, the generator places at least one character from each chosen set into the password, then shuffles the result so they appear in random positions.

What does Exclude ambiguous characters do?

It removes the characters I, l, 1, O and 0 from the pool, which are easily confused with each other when a password is read aloud, typed quickly or written down.

What password length should I use?

Sixteen characters with all four character sets is a strong default. Go longer (up to 64) for master passwords, and only shorten when a specific site imposes a lower maximum.

Are generated passwords stored anywhere?

No. Generation happens entirely in your browser. The recent-passwords list lives only in memory for the current session and disappears when you close the page.

Why does the strength bar call a short symbol-heavy password weak?

Because length dominates entropy. An 8-character password, even with symbols, has far fewer possible combinations than a 16-character one, and the bar reflects that arithmetic.

Can I generate a PIN or numbers-only password?

Yes. Untick every set except Numbers and choose your desired length. A 12-digit random PIN still carries meaningful entropy, far more than a date or an anniversary.

What is the No repeated characters option for?

It forbids any character from appearing twice in the password. The trade-off is that the option only works when the pool is large enough for the chosen length, and it slightly reduces the search space.

How long should a generated password be?

For strong security, generate at least 14 characters, and longer where the service allows. Passwords of 16 or more characters with a good character mix are impractical to crack, even with fast offline guessing.

Should I reuse a generated password across sites?

No. Every account should have its own unique password. If one site leaks its password database, attackers immediately try those credentials on other sites, so a unique password contains the damage to a single account.

🔒

Password Generator

Generate strong, secure random passwords with customizable length and character types.

🚧

Tool Coming Soon

This tool is under development. The admin has created the tool entry, but the functionality file hasn't been added yet.

File expected: tools/password-generator.php

About Password Generator