Password Generator & Strength Checker

Length beats complexity — what the research actually says

The old advice — force an uppercase, a digit and a symbol — is out of date. Modern guidance (NIST SP 800-63B) drops mandatory composition rules and periodic forced resets, because both push people toward predictable patterns (Password1!, Password2!) without adding real resistance to cracking. What matters is entropy, and the cheapest way to buy entropy is length. A 16-character random password from a full character set is already beyond offline brute force; every extra character multiplies the attacker's work.

That's why this generator leads with length. Push it to 20+ for master passwords and wallet seeds, keep all character classes on, and let a password manager remember it so the length never inconveniences you.

Why these passwords are actually random

Randomness is the whole game, and most 'password generator' code gets it wrong by using Math.random(), which is not cryptographically secure and is predictable from a handful of outputs. This tool draws every character from crypto.getRandomValues, the browser's CSPRNG, with rejection sampling so the distribution is uniform (no modulo bias toward the start of the alphabet). The same primitive backs the secure token generator and the keys used by AES encryption.

Passphrases, lookalikes, and the reuse trap

• Passphrases (four or more random words) are easier to type on a TV or console and can carry entropy similar to a shorter random string — pick whichever you'll actually use without reusing it.
• Excluding lookalikes (0/O, 1/l/I) is for passwords a human retypes from a screen or printout; if it goes straight into a manager, leave them in for more entropy.
• The real risk isn't weak passwords, it's reused ones — one breached site exposes every account sharing that password. Generate a unique one per site and check exposure against a breach corpus (Have I Been Pwned) rather than trusting a meter alone.
• A strength meter (this one uses a zxcvbn-style heuristic) estimates guessability, not safety: a 'strong'-rated password you've used elsewhere is already compromised.

Generate locally, store properly

Because generation uses your browser's own crypto and the result never leaves the tab, there's no server that could log the password you just minted — the safest possible place to make a credential. The rule that completes the picture: put it straight into a password manager. Copying a generated password into a notes app or spreadsheet recreates the plaintext-storage problem the manager exists to solve. To gut-check an existing password instead of making one, use the password strength tester.