Password Generator

Yes. The generator uses your browser's built-in Web Crypto API (crypto.getRandomValues) with reject-sampling to eliminate modulo bias, so every character is cryptographically random. No password is sent to a server or logged anywhere; generation happens entirely on your device.

16 characters is a solid minimum for anything that matters, such as email, banking, and work accounts. At that length with all character types enabled, entropy exceeds 100 bits, which the calculator rates "very strong" against a 100-billion-guesses-per-second offline attack. For low-risk accounts, 12 characters is acceptable; for high-value targets, use 20 or more.

Enable all four sets: lowercase, uppercase, numbers, and symbols. The full alphabet is 88 characters, giving you log2(88), about 6.46 bits per character. Dropping symbols shrinks the alphabet to 62 characters and cuts about 0.5 bits per character, a meaningful reduction over a long password.

Entropy measures how many guesses an attacker needs to try before finding your password, and each additional bit doubles that count. The calculator uses the formula bits = length x log2(alphabet size) and rates strength against an offline attack running 100 billion guesses per second. Aim for 70+ bits ("strong") for everyday accounts and 100+ bits ("very strong") for critical ones.

Only if you need to read the password off a screen and type it by hand. Excluding ambiguous characters (0, O, I, l, 1, and the pipe character) removes 6 characters from the alphabet, which slightly lowers entropy. If you copy-paste or use a password manager, leave them in for maximum strength.

Use a password manager such as 1Password, Bitwarden, or Apple Passwords. A password manager lets you generate and store a unique password for every site without memorizing any of them. Reusing passwords across sites is the single biggest practical risk, since one breach exposes every account that shares the same password.