Length beats complexity
A longer password from a smaller alphabet usually beats a short one full of
symbols. Entropy is length × log₂(alphabet size), so each extra character adds
a fixed number of bits, while adding a character class adds a shrinking amount.
Going from 12 to 20 characters is worth far more than adding punctuation to a
12-character password — and it is easier to paste.
What the entropy number means
The bits shown in the status bar describe this generator, not a password someone invented. It is the base-2 logarithm of how many equally likely passwords the current settings can produce:
| Bits | Roughly comparable to | Reasonable for | | --- | --- | --- | | 40 | A 4-word phrase from a small list | Nothing that matters | | 60 | 10 random alphanumerics | An account with rate limiting | | 90 | 14 random alphanumerics | A password manager entry | | 128 | 20 random alphanumerics | A master key or an encryption passphrase |
"P@ssw0rd!" has nine characters and roughly the strength of a two-letter word, because attackers know the substitutions. That is precisely why passwords should be generated rather than composed.
Where these should live
Generate one per account and store it in a password manager. Reuse is the failure that actually causes breaches: a single leaked database turns one weak password into access to everything sharing it. A generator is only half the answer — the other half is somewhere to keep the output.
Questions
Is the randomness actually secure?+
Yes. It uses crypto.getRandomValues, the browser's cryptographically secure generator, and picks each character by rejection sampling so no character is more likely than another. Math.random() is not used anywhere — it is predictable from previous output and unsuitable for anything anyone will treat as a secret.
Does the password leave my browser?+
No. It is generated after the page loads and never sent anywhere. That is also why the page does not show a password in its HTML — a password in a server-rendered response would be cached by every proxy between the server and you.
How many bits of entropy do I need?+
For an account behind rate limiting, 60 bits is plenty. For something exposed to offline cracking — a password manager master key, a disk encryption passphrase, a backup archive — aim for 90 bits or more. The status bar shows the figure so you can decide rather than guess.
What does 'no lookalikes' remove?+
Characters that are hard to tell apart when read or copied by hand: 0 and O, 1 and l and I, and a few quotes and dots. It shortens the alphabet slightly, so the entropy figure drops — add a couple of characters of length if you want to keep the same strength.
Should I use a passphrase instead?+
For anything you have to type from memory, yes. Four or five random words are easier to retype than sixteen random characters and can carry comparable entropy — but only if the words are chosen randomly by a machine. A phrase you thought of yourself is far weaker than it looks.