Password Generator

The Password Generator creates cryptographically strong passwords entirely in your browser using the Web Crypto random number generator, so nothing ever leaves the page. A Length slider moves from 4 to 64 characters with a live character counter, and the default lands on 16. Four checkboxes toggle lowercase letters, uppercase letters, numbers, and symbols, and an "Exclude ambiguous characters" switch removes the lookalike glyphs I, l, 1, O, and 0 to prevent reading mistakes when a password is printed or dictated. The generator guarantees at least one character from each enabled set when the length allows it, then fills the rest from the combined pool and shuffles the result. A strength meter computes entropy as base-two logarithm of the pool size times the length, grading the result Very Weak under 28 bits, Weak under 36, Fair under 60, Strong under 128, and Very Strong beyond that. A progress bar scales the entropy against a 256-bit ceiling, while composition cards count the lowercase, uppercase, number, and symbol characters in the current password. Regenerate rolls a fresh candidate, Copy grabs it from the clipboard, and pressing the G key triggers a new password from anywhere on the page.

1. 1

   Drag the Length slider between 4 and 64 characters; the hint next to the label shows the selected length as you move it.

2. 2

   Tick the Lowercase (a-z), Uppercase (A-Z), Numbers (0-9), and Symbols (!@#$…) checkboxes to control which character sets feed the pool.

3. 3

   Flip the Exclude ambiguous characters switch to ban I, l, 1, O, and 0 from the output for printed or dictated use.

4. 4

   Press Regenerate, or simply tap the G key on your keyboard, to roll a fresh password; the shortcut works wherever your focus is on the page.

5. 5

   Read the Strength and Composition cards, then click Copy to place the password on the clipboard for your password manager or login form.

• New account passwords — generate a 20-character mixed password instead of typing one that reuses an older, already-leaked pattern.
• Wi-Fi network keys — a long random passphrase fits comfortably in most router fields and stays strong for years between changes.
• API tokens and developer secrets — generated strings replace hand-typed tokens that tend to be too short and predictable for automation.
• Master passwords for managers — the copy button feeds a freshly rolled candidate straight into a password vault during first-time setup.
• Rotation scripts — batch-regenerate per-service secrets periodically and paste them into dashboards rather than inventing variations.
• Offline storage — an ambiguous-free password prints cleanly onto paper, so exclude the lookalike set when handwriting a backup.

• Prefer length over gimmicks; every extra character multiplies the search space by the pool size while set diversity adds only log2(pool) bits.
• Keep passwords above 20 characters for critical accounts so the entropy clears the 128-bit bench where state actors stop guessing.
• Enable the ambiguous-character exclusion for anything printed, emailed, or spoken; an unreadable password is worse than a shorter one.
• Use a distinct generated password per service and never recycle; one leaked password must not open the rest of your accounts.
• Store every result in a password manager immediately; the web page and clipboard alone cannot protect a password once the tab closes.
• Remember the strength grade matters less than uniqueness — a Strong 12-char password reused across ten sites still fails on the tenth breach.

• Press G between fills to re-roll until the composition counts match what a site demands, such as a minimum of two digits.
• Turn on the ambiguous exclusion before generating anything you will write by hand, then check the composition before copying.
• Regenerate for a fresh candidate rather than editing an existing password; manual tweaks shrink the effective pool and lower real entropy.
• Verify the strength label against your risk level per account, and log each new password into your manager before the clipboard clears.