How it works
The generator builds passwords from the Web Crypto API's crypto.getRandomValues, the same cryptographically secure random source browsers use for keys. That is a hard requirement for password generation: Math.random is predictable and must never be used for secrets. Each character is drawn uniformly from the enabled character sets, so every position is independent.
You control the length from 4 to 128 characters and the alphabet: uppercase, lowercase, digits and symbols can each be toggled, and an optional filter removes ambiguous characters such as 0/O and 1/l/I for passwords that humans must read aloud or transcribe.
The strength meter shows real entropy in bits — length multiplied by log₂ of the alphabet size — rather than a vague color. A 16-character password over the full 94-character set carries about 105 bits; the meter scales toward 128 bits so you can see the marginal value of each extra character or set.
The passphrase mode generates word-based secrets from a built-in word list: easier to type and remember at equivalent entropy when the word count is high enough. Everything happens locally; generated passwords are never transmitted or stored.
Worked example
Generate a 16-character password with all four sets enabled. The alphabet has 26 + 26 + 10 + 32 = 94 symbols, so entropy is 16 × log₂(94) ≈ 105 bits.
| Configuration | Alphabet size | Entropy |
|---|---|---|
| 8 chars, lower+digits | 36 | 8 × log₂(36) ≈ 41 bits — weak against offline attacks. |
| 12 chars, all sets | 94 | 12 × log₂(94) ≈ 79 bits — reasonable for most accounts. |
| 16 chars, all sets | 94 | ≈ 105 bits — strong default for a password manager. |
| 24 chars, all sets | 94 | ≈ 157 bits — beyond brute-force concerns. |
- Set the length: Drag the slider — 16 is a strong default for manager-stored passwords.
- Choose character sets: Enable the classes the target site accepts; filter ambiguous glyphs if typing by hand.
- Read the entropy: Confirm the bit estimate on the strength meter, not just the color.
- Copy and store: Copy the result into your password manager, or generate a passphrase for memorized logins.
The meter fills proportionally toward the 128-bit reference and labels the result. Disabling symbols drops the alphabet to 62 and the same 16 characters fall to about 95 bits — still strong, but visibly lower.
Common errors and edge cases
- Length beats complexity theater. A 20-character lowercase password (94 bits) outlives an 8-character “complex” one (~52 bits). When a site allows it, prefer length.
- No character set selected. The tool refuses to generate from an empty alphabet and shows an explicit error instead of a silent failure.
- Reuse is the real risk. A unique strong password per site matters more than squeezing out the last few bits; pair the generator with a password manager.
- Ambiguous characters. For passwords typed by hand, enable the no-ambiguous filter to avoid 0/O and 1/l/I mix-ups.
- Policy conflicts. Some sites reject certain symbols or cap length. Adjust the sets to the site's rules rather than weakening every other password.
Code equivalents
Secure generation is a few lines with the right random source. The key rule in every language: use the CSPRNG, never the default PRNG.
| Language | Example |
|---|---|
| JavaScript (browser) | crypto.getRandomValues(new Uint32Array(len)), then map each value into the alphabet with modulo. |
| Python 3 | ''.join(secrets.choice(alphabet) for _ in range(16)) — the secrets module is the CSPRNG. |
| Shell | openssl rand -base64 24 produces 24 bytes of CSPRNG output (then adapt the alphabet). |
Related tools
Frequently asked questions
Is this generator safe to use for real accounts?
Yes. It uses crypto.getRandomValues, the browser's CSPRNG, and everything runs locally with no transmission. Store the results in a reputable password manager.
How long should my passwords be?
For a password manager, 16 characters over the full set (~105 bits) is a strong default; 20+ when the site allows it. For memorized secrets, prefer a 5–6 word passphrase.
Why does the meter use bits of entropy?
Bits measure attacker work directly: each extra bit doubles the search space. It is more honest than color bars based on arbitrary rules.
Are symbols required for a strong password?
No. Length dominates. Symbols help when length is capped, but a long lowercase passphrase can outperform a short complex string.
What is wrong with Math.random for passwords?
Math.random is a deterministic PRNG seeded in a way attackers can often reconstruct. crypto.getRandomValues draws from the operating system's entropy pool and is designed for secrets.
Privacy note
All processing happens in your browser. The values you enter never leave your device and are never transmitted to ToolPlex.