Password Generator

The generator uses crypto.getRandomValues with rejection sampling and returns no password when Web Crypto is unavailable. That provides cryptographically strong pseudorandom selection from the enabled alphabet without modulo bias. Generation runs in the browser, but you should still use a trusted password manager to generate and store account credentials.

Use a unique, randomly generated password as long as the account permits, stored in a password manager. This calculator's strength label assumes uniform random selection from its alphabet and a fixed offline guess rate. It does not account for the site's hash settings, rate limits, phishing resistance, or recovery process.

Enable the character sets accepted by the account. The calculator derives its estimate from the exact enabled alphabet, so a larger alphabet adds entropy when every character is selected uniformly at random. Length and uniqueness usually matter more than satisfying predictable composition patterns in a user-chosen password.

For a uniformly random password, bits = length x log2(alphabet size) describes the search space and each added bit doubles it. The displayed tiers are calculator heuristics based on a fixed offline attack speed, not account-security guarantees. Human-created patterns have much less effective entropy than this formula predicts.

Only if you need to read the password off a screen and type it by hand. Excluding ambiguous characters (0, O, I, l, 1, and the pipe character) removes 6 characters from the alphabet, which slightly lowers entropy. If you copy-paste or use a password manager, leave them in for maximum strength.

Use a password manager such as 1Password, Bitwarden, or Apple Passwords. A password manager lets you generate and store a unique password for every site without memorizing any of them. Reusing passwords across sites is the single biggest practical risk, since one breach exposes every account that shares the same password.