Length Beats Complexity
The advice most people absorbed about passwords, mix in a symbol, swap an o for a zero, change it every ninety days, turned out to make passwords harder for humans to remember without making them much harder for machines to guess. Current guidance from NIST and others points the other way: length is what matters, and forced complexity rules mostly produce predictable substitutions.
This generator uses the browser’s cryptographic random source and lets you set length and character classes directly.
How to Generate a Password
Set the length first. It is the input that does most of the work.
- Set the length. Sixteen characters is a reasonable default for anything that matters, and longer costs you nothing when a password manager does the remembering.
- Choose character classes: uppercase, lowercase, numbers and symbols. All four give the widest pool.
- Read the strength indicator, which reflects both length and how many classes are enabled.
- Copy the result and store it in a password manager rather than anywhere it will be retyped.
- Generate a fresh one for each account. Reuse is what turns one site’s breach into a problem everywhere.
- Uncheck symbols only when a site rejects them, and add length to compensate.
Where the Randomness Comes From
The generator draws from `crypto.getRandomValues`, the browser’s cryptographically secure random source, rather than `Math.random`. That distinction matters: `Math.random` is designed to be fast and statistically even, not unpredictable, and its output can in principle be reconstructed from previous values. Nothing generated here is derived from the time, the page, or anything an observer could reproduce.
With all four classes enabled the pool is 91 characters, worth about 6.5 bits of entropy per character. Sixteen characters is therefore roughly 104 bits, far beyond what offline brute force reaches at any plausible scale. The practical risks to a password are phishing, reuse and database breaches, none of which more entropy protects against.
Entropy by Length and Character Set
Approximate bits of entropy, which is the honest way to compare passwords.
| Length | Lowercase only | Letters + digits | All four classes |
|---|---|---|---|
| 8 | ~38 bits | ~48 bits | ~52 bits |
| 12 | ~56 bits | ~71 bits | ~78 bits |
| 16 | ~75 bits | ~95 bits | ~104 bits |
| 20 | ~94 bits | ~119 bits | ~130 bits |
| 24 | ~113 bits | ~143 bits | ~156 bits |
| 32 | ~150 bits | ~190 bits | ~208 bits |
Adding four characters to a lowercase password buys more than adding every symbol on the keyboard to a short one: 12 lowercase characters beat 8 with all four classes. This is the whole argument for length over complexity in one line.
What a Strong Password Does Not Protect
Entropy defends against guessing, and guessing is not how most accounts are lost. Phishing captures the password as you type it, credential stuffing exploits reuse across sites, and a breach at the service exposes whatever they stored regardless of how strong it was. Two-factor authentication addresses the first two in a way no password length can.
Everything here happens in your browser. Nothing is transmitted, and generated passwords are not stored or logged. That said, generating a password on any web page requires trusting the page, and for the highest-value credentials, your password manager’s own master password, or a recovery key, a local generator built into a manager you already trust is the more conservative choice.