Generate a strong password

A generated password is only as good as the randomness behind it and the secrecy of the channel it travelled through. This one is produced by the browser’s cryptographic random source, the same facility used to create encryption keys, and it is never transmitted. That second point is the whole reason a password generator belongs in the page rather than on a server: a secret that has been sent somewhere is a secret you now share.

Strength is shown as bits of entropy rather than as a coloured bar. Entropy is the honest measure, because it states how much guessing the password actually costs. Every additional bit doubles that work. Around 60 bits is reasonable for something low value, 90 is strong, and 128 or more is comfortable for anything worth protecting. A rule such as requiring one symbol tells you nothing by comparison, which is why the figure is given directly and updates as you change the options.

Length does more than variety. Extending a password raises entropy faster than adding another character class, so a long string drawn from letters alone can beat a short one crammed with punctuation. The lookalike option removes characters that are easily misread, such as capital I, lowercase l, the digit one, capital O and zero, which is worth using for anything that will be typed by hand or read aloud.

One detail that is invisible but matters: characters are drawn by discarding and redrawing values that fall outside an even range, rather than by taking a random byte modulo the alphabet size. The shortcut makes the first characters of the alphabet slightly more likely and quietly shrinks the real key space. Nothing here does that.