Formula
strength (bits) = length × log₂(number of possible characters)e.g. 16 characters from 85 possible (26 + 26 + 10 digits + 23 symbols): 16 × log₂(85) ≈ 103 bits
- Each character is chosen independently and uniformly at random
- At least one character from each chosen group is guaranteed
More characters and a bigger character pool both make a password exponentially harder to guess.
Worked example
A 16-character password with all character types
- Length
- 16 characters
- How many passwords
- 1
- Lowercase letters (a–z)
- Yes
- Uppercase letters (A–Z)
- Yes
- Digits (0–9)
- Yes
- Symbols
- Yes
- Avoid look-alike characters (I l 1 O 0 o)
- No
Password
_PC;]8bQNj6Hb[1Z
Strength: Very strong (about 103 bits)
Characters to choose from: 85
How it works
Passwords are built from the browser's cryptographically secure random number generator (the same source used for encryption keys), not from Math.random. Each position is picked uniformly using rejection sampling, which avoids the slight bias that a simple remainder would introduce, and the finished password is shuffled so the guaranteed characters from each selected group do not sit in predictable places. Nothing is sent to a server and nothing is stored.
The strength figure is length multiplied by the base-2 logarithm of the number of characters available. It is an honest estimate for a truly random password, which is what is generated here. A password you invent yourself, or one made of words and substitutions like P@ssw0rd, is far weaker than its length suggests. Length matters most: adding four characters usually helps more than adding a symbol, and for important accounts 16 or more characters is a sensible choice.
Use a different password for every account and keep them in a password manager rather than reusing or memorising them; turn on two-step verification where it is offered. If a site restricts which symbols it accepts, list the allowed ones, and use the look-alike option if you will type the password by hand. For other random values see the UUID Generator, and to fingerprint text use the Hash Generator.
Assumptions and limits
- Passwords are generated locally with the browser's secure random generator and are not stored.
- The strength estimate assumes an attacker must guess every character; it does not account for a site's own weaknesses.
- Some sites limit length or symbols; use the symbol field to match their rules.