Generate secure, strong random passwords completely on your device.
Picture an office manager, Marisol, who finds that the same eight-character password protects 14 shared logins for a six-person dental practice. One leaked login and all 14 accounts are exposed. This generator builds a fresh random string from the character sets you tick, then shows the entropy in bits so you can see how much guessing room a given length and character mix actually buys.
Start with the pool. At the default settings (lowercase, uppercase, numbers and symbols all ticked, ambiguous characters excluded) the page begins with 26 + 26 + 10 + 23 = 85 characters, then drops the seven it treats as ambiguous (i, l, o, 1, L, 0, O). That leaves a pool of 78.
Every character is drawn independently and with equal chance from that pool, so a password of length L has pool^L equally likely outcomes. Entropy in bits is the base-2 logarithm of that count: entropy = L × log2(pool).
Default run: log2(78) = 6.285 bits per character, and 10 characters × 6.285 = 62.9 bits. The page rounds to one decimal and labels anything under 40 bits Weak, 40 to under 60 Moderate, and 60 or more Strong. So the default password only just crosses into Strong.
Change one input and watch the number move. At length 12 the same pool gives 75.4 bits; at 16 it gives 100.6. Untick symbols and the pool shrinks to 55, so 12 characters give 69.4 bits, which is still higher than the default 10 with symbols. A lowercase-only password of 8 characters (pool of 23) scores 36.2 bits and lands in Weak. Length usually matters more than the character mix.
To turn bits into something physical: 2^62.9 is about 8.3 × 10^18 combinations. If an attacker stole a file of fast, unsalted hashes and could test one trillion guesses per second (an assumed rate, not a measured one), finding the password would take about seven weeks on average. At 12 characters the same assumption gives roughly 800 years. Slow password hashing, rate limits and two-factor login change those figures enormously, so read them as a comparison, not a promise.
No. The label is only a band applied to the entropy number: under 40 is Weak, 40 to 60 Moderate, 60 and above Strong. It assumes the password is truly random and used in one place. A Strong string that you reuse on three sites, or that appears in a breach, protects nothing.
The generator keeps drawing until it has enough different characters. If the length is larger than the pool, for example numbers only (8 digits left after the ambiguous filter) with length 10, it can never finish and the tab appears stuck. Lower the length or add another character set.
Be careful here. The generator uses JavaScript's Math.random, which is fine for ordinary accounts but is not a cryptographic random source. For a master password or a crypto wallet, use your password manager's own generator or physical dice.
Exclude Ambiguous Characters is on by default so you can read a password aloud or retype it from paper without guessing. The cost is small: the pool falls from 85 to 78, about 1.2 bits less over 10 characters. Untick it if the password will only ever be pasted.
No, it makes it slightly weaker, because it removes possibilities. The page still shows the plain L × log2(pool) figure, so the entropy readout is a little optimistic when that box is ticked. Leave it off unless a site's rules force it.
Often, yes, but this page does not build passphrases. For comparison, words picked at random from a 7,776-word Diceware list give about 12.9 bits each: four words is 51.7 bits and six is 77.5 bits, and a phrase is easier to type on a phone.