What makes a password strong
Strength comes from two things: length, and the number of possible characters at each position. A password drawn at random from 90 characters gains about 6.5 bits of entropy per character, so 16 characters give about 104 bits, far more than any guessing attack can work through. A short password with clever swaps, such as P@ssw0rd, is weak because attackers try those patterns first. Randomness and length beat tricks.
How this generator picks characters
Every character comes from crypto.getRandomValues, the same secure random source browsers use for encryption keys. The tool avoids modulo bias by throwing away the few random values that would favour some characters, makes sure at least one character of each type you ticked is present, and then shuffles the result so those guaranteed characters are not always at the start. Nothing can be worked out from the time of day or from earlier passwords.
When to skip look-alike characters
The capital I, the small l, the digit 1 and the bar |, and also the capital O and the digit 0, look alike in many fonts. If you will dictate a Wi-Fi password to a guest, write it on a card or type it from a printed sheet, removing them prevents mistakes. It costs very little strength: the pool shrinks by a handful of characters, which one or two extra characters of length more than make up for.
Storing and using your new password
Use a different password for every account, so a leak at one site does not unlock the others. A password manager, including the one built into your browser or phone, can save each password and fill it in for you, so you never have to remember them. Turn on two-step verification wherever a site offers it: a strong password plus a second factor stops most account takeovers.
Matching a site’s password rules
Banks, government portals and older company systems often publish a rule such as “8 to 16 characters, at least one capital, one number and one of !@#$%”, or forbid quotes and angle brackets. Type those allowed symbols into the Site rules box and only they will be used; type banned characters into the second box and they are removed from every set. Each ticked set is still guaranteed to appear at least once, so the result passes the usual “must contain” checks on the first try, and the strength bar recalculates from the smaller character pool.
Pronounceable passwords and bulk lists
Pronounceable mode alternates consonants and vowels, leaving out letters that are easy to mishear, then can add capitals, two digits and a symbol. Each character carries less randomness than a fully random one, so choose about 20 characters for strong protection. The bulk option makes up to 100 passwords that are all different from each other, which helps an IT admin preparing first-login passwords for new staff or a shop setting up several till accounts. Tell people to change a first-login password straight away.
Other password tools
Each of these does one job well. Use the passphrase generator for something you must remember and type, the PIN generator for cards and keypads, the Wi-Fi tool for a router key with a join-network QR code, the htpasswd generator to protect a folder on an Apache server, and the strength checker to test a password you already use.
Limits and privacy
There is no sign-up and no daily limit. Passwords are created inside the page and vanish when you close or refresh it; we do not log, store or transmit them. Some sites still cap the length or refuse certain symbols. If a form will not accept your password, untick symbols or shorten it and generate again.