Password Generator

// What is tested

• Nothing is tested. This tool generates rather than checks, and it runs entirely in your browser — no password is transmitted to any server or stored anywhere.
• Each character is drawn independently and uniformly from the selected pool using the browser's cryptographic random source.
• The strength figure shown is Shannon entropy for the chosen settings: length multiplied by log₂ of the pool size, rounded to the nearest bit.

// Data sources

Web Crypto API

crypto.getRandomValues(), the browser's cryptographically secure pseudorandom number generator, seeded by the operating system. No server-side randomness is involved and no network request is made.

// Limits

• Characters are chosen by rejection sampling: a 32-bit random value is discarded and redrawn if it falls in the range that plain modulo reduction would over-represent. Selection is therefore uniform, not approximately uniform. For the pool sizes offered a redraw happens roughly once in 100 million characters.
• The entropy figure describes the generator's output for those settings. It is not a measure of how hard a specific password is to guess — that depends on whether it has been exposed elsewhere, which no generator can know.
• Excluding ambiguous characters shrinks the pool and therefore lowers entropy at the same length. The figure shown accounts for this.
• The generator does not enforce that every selected character class appears in the output. At the default length the chance of a class being absent is negligible; at very short lengths it is not.