What makes a password strong?
A password's resistance to guessing is measured in entropy — the number of equally likely possibilities an attacker would have to search. Entropy grows with both the length of the password and the size of the character set each position is drawn from, and it assumes every character is chosen unpredictably. A short password, or one based on a word or predictable pattern, has low entropy no matter how many symbols you sprinkle in.
This generator builds passwords from the character sets you enable — lowercase, uppercase, digits, and symbols — at a length you control, so you can dial the entropy up to whatever your threat model and any corporate complexity policy require. Crucially, entropy assumes the attacker already knows your scheme; security comes from the unpredictability of the choices, never from keeping the method secret.
Why the source of randomness matters
Not all randomness is equal. Ordinary pseudo-random generators, like the one behind a typical Math.random call, are fast but predictable: given enough output an attacker can reconstruct their internal state and anticipate future values. That is fine for shuffling a playlist and unacceptable for a secret.
This tool uses the Web Crypto API's cryptographically secure generator and selects each character without modulo bias, so every character in the alphabet is equally likely and the password's full theoretical strength is preserved. The result is randomness suitable for real credentials, generated entirely on your device. This distinction is not academic: predictable randomness has been the root cause of real-world vulnerabilities in tokens, session identifiers, and generated keys.
Length, passphrases, and password managers
When you must choose, length beats complexity: a long password from a modest character set generally has more entropy than a short one crammed with symbols, and it is easier to handle. For secrets you occasionally type, a long random passphrase of several unrelated words is a strong and memorable alternative.
The practical way to use strong, unique passwords everywhere is a password manager. Generate a high-entropy value here, store it in your manager, and let it fill the credential automatically — so you never reuse a password across sites, which is the single habit that most often turns one breach into many. Treating every credential as disposable and unique, backed by a manager, is the foundation of good password hygiene and scales far better than trying to remember dozens of complex strings. The generator simply removes the last excuse for weak or repeated passwords by making a strong one available instantly.