Password Generator

Length beats complexity. A password's resistance to guessing is roughly its alphabet size raised to its length, so adding one character multiplies the work an attacker faces, while swapping a for @ merely adds a rule that cracking tools have modelled since the 1990s. Sixteen random lowercase letters are far harder to break than P@ssw0rd!.

The other half is randomness, and this is where humans fail reliably. People asked to pick "random" characters produce keyboard patterns, dates and words with predictable substitutions — the exact shapes wordlists are built from. This generator draws from crypto.getRandomValues(), the browser's cryptographically secure random source, which is designed so that seeing part of the output tells you nothing about the rest. That is a different guarantee from Math.random(), which is fast, predictable, and unsuitable for anything secret.

How long should it be?

For an account protected by a password manager, 20 or more characters costs you nothing because you will never type it. For something you must type by hand, 16 characters with mixed case and digits is comfortable and still strong. Below 12 you are relying on the service's rate limiting rather than on the password.

The strength meter here scores length first and character variety second, which is why a long lowercase password can outrank a short one full of symbols. That ordering is deliberate and reflects how offline cracking actually works.

Nothing leaves your browser

This tool is entirely client-side. No password is transmitted, logged or seen by any server — the page generates them locally in JavaScript, and you can confirm that by opening the network tab and watching nothing happen. That property matters more here than on almost any other page: a password generator that phones home is worse than no generator at all.