Password generator.

Length beats complexity. A twenty-character password made only of lowercase letters is far harder to crack than eight characters of mixed symbols, and considerably easier to handle if you ever have to type it. The entropy readout under the output shows the real number: how many bits of randomness you actually have, calculated from length and character set.

Anything under 50 bits is weak against a serious offline attack. Around 70 is solid for a normal account. Above 100 is appropriate for anything protecting other credentials — a password manager master password, a server root account, a domain registrar login.

The randomness comes from the Web Crypto API, not Math.random(), which is predictable and has no business generating credentials. The generation is also rejection-sampled so that no character is more likely than another, avoiding the modulo bias that quietly weakens a lot of homemade generators. Nothing is transmitted, logged or stored — the password exists only in your browser until you close the tab.

Worth knowing

• Use a password manager. A generated password you cannot remember is only useful if something else remembers it.
• Lookalike characters are excluded by default because transcription errors waste more time than they are worth.
• Turn on two-factor authentication everywhere it exists. It matters more than password strength.