Password Generator - Secure & Random

Most password meters are theatre. They add a point for an uppercase letter, a point for a digit, a point for a symbol, and colour the bar green once you have collected enough points. That rewards the wrong thing. The real measure of a random password is its entropy— the number of bits needed to describe how many equally-likely passwords your settings could have produced. This tool shows that number directly, and rates the bar on it.

The formula is H = L × log₂(R), where L is the length and R is the size of the character pool. Each position drawn from a pool of R characters contributes log₂(R) bits. With everything enabled the pool here is 91 characters (26 + 26 + 10 + 29 symbols), so each character adds about 6.5 bits. Lowercase-only is a 26-character pool at 4.7 bits per character. Entropy is just those per-character bits multiplied by how many characters you have.

Here is the comparison that surprises people. A 16-character password using only lowercase letters is about 75 bits (16 × 4.7). An 8-character password using uppercase, lowercase, numbers, and symbols is only about 52 bits(8 × 6.5). The “simple” long one is over 8 million times harder to guess than the “complex” short one, because entropy grows linearly with length but only logarithmically with pool size. Doubling the length doubles the bits; adding a whole new character class adds barely a bit or two per character.

This is why the classic advice to jam in a symbol and a capital is less useful than simply making the password longer. Adding symbols to a 16-character password takes it from about 75 bits to about 104 — helpful, but a smaller jump than going from 8 to 16 characters in the first place. If you have to choose one lever, choose length. The tool defaults to 16 with all sets on (about 104 bits) for exactly this reason.

A strong random password only helps if you never reuse it. The most common way accounts fall is not brute force at all — it is credential stuffing, where a password leaked from one breached site is tried against every other account you own. A 104-bit password reused across ten sites is a 104-bit password with ten times the exposure. The fix is a unique password per site, which in practice means a password manager, because no one memorises dozens of random strings.

This tool also does not store, sync, or remember anything. That is deliberate — there is nothing here to breach — but it means the moment you generate a password, getting it into a manager or a safe place is on you. And a password is only one factor: turn on two-factor authentication wherever it is offered, so that even a leaked password is not enough on its own.

Note: Entropy measures resistance to guessing a randomly generated password. It says nothing about phishing, malware, or reuse. Store generated passwords in a reputable manager and pair them with two-factor authentication.