Password Generator

Most password generators online are a length slider and a green bar. This one is built on a different premise: the number that matters is not how complicated a password looks, but how many attempts an attacker would need to break it. That number is measurable, this app measures it, and every choice you make in the interface moves it.

Randomness that holds up to scrutiny

Every character comes from crypto.getRandomValues(), the cryptographic generator your browser already uses for TLS keys. This is not a detail. The Math.random() function found in most online generators is not designed for security: it is fast, it is predictable, and its internal state can be reconstructed from a short sequence of observed values. In a generator of lottery numbers that would be irrelevant. In a generator of passwords, it means the output is not random in the sense anyone needs it to be.

Length from 8 to 64, and the reason to go past 16

The NIST no longer asks for symbol substitutions or forced rotation schedules. Its current guidance is a minimum of fifteen characters for single-factor authentication, with longer passphrases allowed in place of complexity rules. Fifteen lowercase characters carry about 70 bits of entropy. Eight mixed characters with symbols carry about 44. The longer option wins, and it wins without any of the frustration of remembering which characters you are supposed to avoid.

Passphrases, for when you cannot store everything

Random strings are the strongest option and the least memorable. That is fine when a password manager holds them, and a poor choice for the accounts you sign into twice a year. Passphrase mode joins random words from a list of 1,758, and each word carries about 10.9 bits because the number of possible words is what creates the uncertainty, not their length. Four words give roughly 44 bits in something you can reconstruct without writing it down.

Dropping the characters people confuse

Zero and capital O, one and lower-case L, capital I and lower-case i. On a good screen with a clear font they are easy to tell apart. Transcribed by hand from a screen onto paper, or recalled aloud over the phone three months later, they are the most common reason a correct password gets rejected. One option removes all of them, and the small loss of entropy is worth not having to try twice.

Entropy in bits, and what that buys you

The strength meter reports bits rather than a score out of one hundred. The formula is the standard one, from NIST SP 800-63-4: length multiplied by the base-two logarithm of the alphabet size, counted from the character classes the password actually contains rather than the ones selected. Each bit doubles an attacker's work, so sixty bits is a million times harder than twenty. The meter also shows roughly how long the result would hold against an offline attack, which is a more useful thing to know than a colour.

History that does not survive the tab

The session history keeps the last ten results so you can go back to one, and lives entirely in the open page. Nothing is written to local storage or sent anywhere. That is a deliberate choice rather than a missing feature: a password saved to your browser profile outlives the tab, survives a shared computer, and is readable by anyone who opens that profile.

Moving a password without typing it

Because passwords are long by design, getting one from the computer to the phone usually means typing it, which is exactly the moment it leaks into a chat log or a keyboard that learns it. The QR code moves it as an image instead, and the image is cleared from memory when you close the panel. Pair it with the QR and Barcode Scanner to read it straight back.

What it does not do

There is no account, no email address, no analytics on what you generate, and no server that could be compromised. Generation happens in the browser, the app installs as a PWA, and it keeps working with the network off. For a tool whose purpose is handling credentials, having nothing to leak is worth more than any feature that needs a connection.