Password Generator

How to Use

1. Set the desired password length using the slider (8–128 characters). Longer passwords are always stronger.
2. Check or uncheck the character type boxes: Uppercase, Lowercase, Numbers, and Symbols. At least one type must be selected.
3. Optionally enable Exclude Similar to remove characters that look alike (l, 1, I, 0, O) — useful when you need to manually type or read the password.
4. Optionally enable Exclude Ambiguous to remove symbols that can cause parsing issues in certain systems ([]()/\'"`~,;.<>).
5. Click the Generate button to create a new password. The strength meter updates automatically.
6. Click the Copy button to copy the password to your clipboard for immediate use.
7. Switch to Passphrase mode to generate word-based passwords instead. Choose the number of words and separator character.
8. The last 5 generated passwords are kept in a history list below for easy reference during your session.

Password Strength Explained

Password strength is measured in bits of entropy — a mathematical concept that quantifies how unpredictable a password is. The formula is simple: entropy = length × log₂(charset_size). For example, a 12-character password drawn from 89 possible characters (26 uppercase + 26 lowercase + 10 digits + 27 symbols) has 12 × log₂(89) ≈ 78.2 bits of entropy.

The strength meter classifies passwords into five tiers:

• Weak (< 40 bits) — crackable in seconds to minutes
• Fair (40–59 bits) — crackable in hours to days
• Good (60–79 bits) — crackable in years with significant resources
• Strong (80–119 bits) — practically uncrackable with current technology
• Very Strong (120+ bits) — uncrackable even with theoretical future hardware

For comparison, a typical 8-character password with only lowercase letters has just 37.6 bits of entropy — well within the Weak range. Modern GPUs can brute-force such passwords in minutes. The same 8 characters with all four character types gives 52.4 bits (Fair), while extending to 16 characters with all types yields over 100 bits (Strong). This is why length matters more than complexity — each additional character multiplies the search space.

Passphrases vs Passwords

A passphrase is a sequence of random words strung together, like hunter-guitar-violet-cabin. A password is a sequence of random characters, like K7#mQ!vL2pR$wX9n. Both can be secure, but they serve different needs.

Passphrases have two key advantages. First, memorability: humans are evolved to remember words, not random character strings. A 4-word passphrase is far easier to recall than a 16-character password. Second, entropy: even with a vocabulary of just 200 words, a 5-word passphrase has 5 × log₂(200) ≈ 38.2 bits of entropy from the word selection alone — and with a larger dictionary like the 7,776-word EFF word list, that jumps to 5 × log₂(7776) ≈ 64.6 bits.

Passwords have the advantage of compactness: they pack more entropy into fewer characters, which matters when a system imposes a maximum length limit. A 16-character password with all character types has over 100 bits of entropy, while a 16-character passphrase (only 2–3 words) would have far less. Passwords are also required by some systems that don't accept spaces or multi-word inputs.

The best approach depends on your use case. Use a strong random password stored in a password manager for most accounts — you don't need to remember it. Use a passphrasefor situations where you must memorize the credential, such as your password manager's master password or a device login. Our tool supports both modes — switch between them with a single toggle.