Password Generator

The strength of a random password is a function of how many possible passwords exist given its length and character set, and that number grows exponentially with length but only linearly with the size of the character set — adding one more character position multiplies the total possibility space, while adding one more allowed symbol type barely moves it. A 20-character password using only lowercase letters draws from 26 possibilities per position across 20 positions, which works out to vastly more total combinations than an 8-character password drawing from a much richer set of 94 possible characters (uppercase, lowercase, digits and symbols combined) but with only 8 positions to place them in. This is the mathematical reason length is the dominant factor in password strength, and why the long-standing advice to add symbols and mixed case matters far less than simply making the password longer.

Not all random number generators are equally unpredictable. `Math.random()`, the general-purpose random function built into JavaScript, is designed for speed and statistical distribution in things like animations or shuffling a game board — it is not designed to resist an attacker who is specifically trying to predict its output, and in some implementations its internal state can be partially reconstructed from a handful of observed outputs. `crypto.getRandomValues()`, the API this tool uses instead, draws from the operating system's cryptographic random number source — the same underlying source used to generate encryption keys — which is built and audited specifically to resist exactly that kind of prediction attack. Using anything other than a CSPRNG (cryptographically secure pseudorandom number generator) for password generation is a genuine, exploitable weakness, not a theoretical one — several published password generator bugs have come from exactly this substitution.

Entropy, measured in bits, describes how many attempts an attacker would need to exhaustively try every possibility before finding the right one — each additional bit doubles that number, so the relationship is exponential rather than linear, and a jump from 60 to 70 bits represents a thousand-fold increase in the attacker's workload, not a modest ten-unit improvement. Below roughly 50 bits, sustained brute-force attacks using modern hardware become genuinely feasible within a practical timeframe. The 70–80 bit range is considered comfortable for an ordinary password protecting a typical online account. Above 100 bits is comfortably beyond what any currently conceivable computing effort could exhaust, which is why this tool's guidance and its strength meter both anchor around these specific thresholds rather than a vague "make it stronger" recommendation.