Password Generator

What makes a password strong

Strength is about how many guesses an attacker needs, not about how strange the password looks. Two things decide that: the size of the character pool and the length. Together they give the entropy in bits:

entropy = length × log₂(pool size)

A 12-character password using upper- and lower-case letters, digits and symbols draws from 89 characters, so each character adds about 6.5 bits: 12 × 6.48 ≈ 78 bits. Every extra character multiplies the guesses by 89; every doubling of the pool adds only one bit per character. That is why length beats complexity — a 20-character lowercase password (94 bits) is stronger than a 12-character one with symbols.

The strength labels here follow that maths: under 40 bits is weak (crackable offline in minutes), 40–60 fair, 60–80 strong, and above 80 very strong enough for anything that matters.

Passwords vs passphrases

A passphrase strings together random words: Copper-Lantern-Falcon-Tide. With a 363-word list, each word adds about 8.5 bits, so four words give 34 bits and six give 51 bits — less than a 16-character random string, but far easier to type on a phone and to remember for the one or two passwords you cannot store in a manager (your laptop login, your password manager’s master password). Add a number or use seven words for those.

The word list here is deliberately short and made of common, easily spelt words. Do not “improve” a generated passphrase by picking words you like; the security comes from the random choice.

Handling site restrictions

Many Indian banking and government portals reject certain symbols or cap the length at 16 or 20 characters. Use the Exclude characters box to remove whatever the site forbids, and shorten the length to the maximum allowed — a 16-character password from a full pool is still about 100 bits. Exclude ambiguous drops 0 O 1 l I |, which helps when a password has to be read aloud or typed from paper.

Each generated password is guaranteed to contain at least one character from every selected type, so it passes “must include an uppercase letter and a digit” rules on the first try.

Good habits

• Never reuse a password. Credential leaks from one site are tried automatically on every other site. A password manager (Bitwarden, KeePass, the one built into your browser) makes unique passwords painless.
• Turn on two-factor authentication for email, banking and UPI apps. Even a very strong password cannot help if it is phished.
• Change passwords only when there is a reason — a breach notice or a device you no longer trust. Routine forced changes tend to produce weaker, predictable patterns.
• Do not send passwords over WhatsApp or email. If you must share one, use the manager’s sharing feature or a one-time link.

How the randomness works

The generator calls crypto.getRandomValues(), which reads from the operating system’s secure random source. Each character is chosen by rejection sampling, so no value in the pool is ever slightly more likely than another — a flaw that affects naive random() × pool implementations. Everything happens in your browser and nothing generated is sent or stored anywhere.

Frequently asked questions