Password Generator

A strong password is, at its core, a string that is hard for both a person and a computer to predict. The single biggest factor in how hard a password is to guess is not cleverness — swapping an "a" for an "@" or ending in "123!" — but entropy: how many possible passwords exist given the length and character set used, and how randomly one was actually picked out of that space. A truly random 16-character password drawn from upper case, lower case, digits and symbols has roughly 105 bits of entropy, which puts a brute-force guess firmly outside any realistic timeframe, even for an attacker with enormous computing resources. A memorable password chosen by a person, by contrast, tends to draw from a far smaller effective space than its length suggests, because people gravitate toward dictionary words, keyboard patterns and predictable substitutions that password-cracking tools already account for. This is why password generators exist: computers are far better than people at picking truly unpredictable characters, and a generated password never needs to be memorised if it's kept in a password manager — which is how most current security guidance recommends handling passwords, rather than reusing a handful of memorable ones across many sites. The length slider matters more than most people expect. Every additional character multiplies the size of the guessing space by the size of the character pool, so a 20-character password is astronomically harder to crack than a 12-character one, even using the exact same character types — length compounds, it doesn't just add. Two convenience options sit alongside the core generation controls. "Exclude ambiguous characters" removes characters that are easy to misread or mistype when a password needs to be typed by hand rather than pasted — useful for a password read off a screen, printed, or dictated over the phone. "Exclude duplicate characters" guarantees no character repeats, which a small number of legacy systems and printed forms still require, though it slightly narrows the space of possible passwords for a given length. Neither option should be enabled by default for maximum-security use cases, since both reduce the total number of possible outcomes for a given length — every excluded character is one less option at each position. Every character in this generator is chosen using the browser's cryptographically secure random number generator (the Web Crypto API), not JavaScript's ordinary Math.random(), which is not designed to be unpredictable enough for security purposes. The entire process — generation, strength scoring, and copying — runs locally in your browser. The passwords this tool creates are never transmitted, logged, or visible to anyone but you, and closing or refreshing the page discards them completely.