What makes a password strong
A password is as strong as it is hard to guess. That is measured as entropy in bits: every bit doubles the number of attempts an attacker needs on average. For a randomly generated password it is length × log₂(pool size). Random is the key word: a password you make up yourself almost always has far less entropy than it looks — “Summer2024!” satisfies every complexity rule and still sits in every wordlist.
- Length beats complexity. One more character gains more than one more character type: 16 lowercase letters give 75.2 bits, 12 characters from all 94 printable ASCII characters only 78.7 bits.
- Never reuse a password. When one service is breached, attackers automatically try the stolen credentials on other services. A strong password you use five times is only as safe as the weakest of those five services.
- Use a password manager. It remembers the random passwords, so you only have to remember one strong master password (ideally a passphrase) and your two-factor login.
- Turn on two-factor authentication wherever it exists: it still protects you if a password leaks.
Reference values (entropy when generated randomly): 8 characters from 94 = 52.4 bits · 12 = 78.7 bits · 16 = 104.9 bits · 20 = 131.1 bits. Passphrase with this word list: 4 words = 40 bits · 6 = 60 bits · 8 = 80 bits. For online accounts that lock after failed attempts, roughly 60–80 bits are enough; for a master password or encryption, where an attacker can guess offline without limit, 80 bits or more makes sense.
Password or passphrase?
A random password of letters, digits and symbols packs a lot of entropy into few characters — ideal when a password manager fills it in and you never have to type it. A passphrase of randomly drawn words is longer but easier to remember and type: it suits the master password of your password manager, your computer login or disk encryption.
The word list here has exactly 1024 words, so each word adds 10 bits. Five words give 50 bits, seven give 70, eight give 80. The method stays safe even if an attacker knows the list — the strength comes from the randomness of the choice, not from keeping the list secret. What matters: the words must really be drawn at random. Words you pick yourself are usually far more predictable. The optional digit adds about 3.3 bits; capitalisation and separators do not change the entropy, they only help with login forms that insist on a format.
How it is generated here (CSPRNG)
The random numbers come from crypto.getRandomValues, the browser's cryptographically secure random number generator (CSPRNG), which is seeded by the operating system. Math.random() is deliberately not used: it is not meant for secrets and its output is predictable.
So that no character turns up more often than the others, drawing avoids the usual modulo bias: a 32-bit random number is turned into an index only if it falls in the largest range that divides evenly over the pool; otherwise a new number is drawn (“rejection sampling”). Every character is drawn independently from the whole pool. If a result lacks one of the selected character types, the whole password is discarded and generated again — that way every selected type is present without skewing the result.
The entropy shown is length × log₂(pool size); for 20 characters from 94 symbols that is 131.1 bits. Excluding look-alike characters (0, O, 1, l, I) lowers it only slightly (89 instead of 94 characters). Requiring every selected type costs only fractions of a bit at normal lengths. It all runs in your browser: there is no network request and nothing is stored.
Questions
Is it safe to generate a password in a browser? Yes, as long as the browser and the device are trustworthy. The browser's random generator exists for exactly this purpose. The password is computed locally and not transmitted; you can read this page's source yourself, and after loading you can even disconnect from the network. What would be unsafe is a machine with malware or a dubious browser extension — no generator can help against that.
Can the site operator see my password? No, it never leaves your browser. How long should it be? For accounts with a password manager 16–20 characters, for a master password a passphrase of at least 6–7 words. Do I need symbols? Only if a service demands them; more length usually gains more. Some services reject certain special characters — then untick symbols and raise the length. Should I change passwords regularly? Not without a reason: change one when a service was breached or you reused it. Clipboard: copied passwords can end up in clipboard-history features; a password manager handles that more safely.
Privacy
Runs entirely in your browser; nothing is sent or stored.