Password Generator

How the password generator works

The generator builds an alphabet from the character classes you enable: 26 lowercase letters, 26 uppercase letters, 10 digits, and 32 printable ASCII symbols. With all four classes on, the alphabet holds 94 characters. For each position in the password it draws one character uniformly at random from that alphabet, using the browser’s cryptographic random source (crypto.getRandomValues), never a general-purpose pseudo-random function.

Picking a character means turning a random byte (0 to 255) into an index into the alphabet. A naive byte % n would make some characters slightly more likely than others, because 256 is rarely a clean multiple of the alphabet size. To remove that modulo bias, the tool uses rejection sampling: it computes max = floor(256 / n) * n, the largest multiple of n that fits in a byte, and discards any byte that lands at or above max, drawing a fresh one. Surviving bytes map onto every index 0 to n-1 with exactly equal probability. Strength is reported as Shannon entropy in bits: entropy = length * log2(alphabetSize).

Worked example

Suppose you request a 16-character password with all four classes enabled.

Step	Value
Alphabet size n	26 + 26 + 10 + 32 = 94
Bits per character	log2(94) = 6.5546
Total entropy	16 * 6.5546 = 104.87 bits
Rejection cutoff max	floor(256 / 94) * 94 = 188
Chance a byte is rejected	1 - 188/256 = 26.6%

For each of the 16 characters the tool reads a byte. If the byte is 188 or higher it is thrown away and another is read; otherwise the index is byte % 94. About one byte in four is rejected here, which is invisible to you and guarantees a perfectly even spread. The result is a 16-character string carrying roughly 105 bits of entropy.

How to use it

• Set the length first. Length adds entropy faster than anything else. 16 characters is a strong default; go to 20 or more for high-value accounts (20 characters across all classes is about 131 bits).
• Keep all four character classes on unless a site forbids a class. Each class you remove shrinks the alphabet and lowers bits per character.
• Read the entropy figure, not just the length. A long digits-only password is weaker than a shorter mixed one because each digit contributes only log2(10) = 3.32 bits.
• Copy and store in a password manager immediately. Because nothing is saved, an uncopied password cannot be recovered.
• Generate a fresh password per account. Unique secrets contain the damage if one site is breached.

Limitations

Entropy here measures the strength of a password chosen uniformly at random, which is exactly how this tool generates it. That figure does not account for how the secret is handled afterward: a strong password stored in plain text, reused across sites, or captured by malware or phishing offers no real protection. The number also assumes an attacker who must guess blindly; it says nothing about a server that stores passwords poorly. Treat the bit count as a measure of the string itself, not of your overall account security, and pair every generated password with a reputable password manager and two-factor authentication.