Generate strong passwords, memorable passphrases, API keys or PINs, with the strength reported as real entropy in bits instead of a vague coloured bar. Everything is produced by your browser’s cryptographic random number generator.
Password strength is measured in entropy — how many equally likely possibilities an attacker has to work through — and entropy comes from length far more than from punctuation. A 16-character random lowercase string has more of it than an 8-character string with every symbol class forced in, and it is easier to type.
The characters here come from crypto.getRandomValues(), the browser’s cryptographic random source, rather than Math.random(), whose output is predictable from earlier values and must never be used for a secret. Passphrase mode assembles words instead, which is the option worth taking when a human has to retype the result. The estimated entropy is shown in bits so the choice is a number rather than a colour.
Composition rules were meant to force variety and mostly produce predictability. Requiring an uppercase letter, a digit and a symbol pushes people towards a capital at the front, a digit at the end and an exclamation mark after it — a pattern attackers model directly, so the rule removes more entropy from the search space than it adds. NIST guidance has recommended against imposing composition rules for years, in favour of length and screening against known-breached passwords. Where a site still insists, generating a compliant random string is better than inventing one that satisfies the rule.
Length is the variable that matters, and the arithmetic shows why. Each extra character multiplies the search space by the size of the alphabet, so adding one character to a 62-character alphabet does more than adding thirty symbols to the alphabet of a short password. A 16-character random lowercase string carries around 75 bits of entropy; an 8-character string using every printable ASCII character carries about 52. The longer, simpler one is both stronger and easier to type on a phone.
A passphrase is the option to take whenever a human has to retype the result — a device password, a disk encryption key, a recovery phrase written on paper. Several unrelated words carry real entropy provided the words are chosen randomly rather than by a person, because a phrase someone thought of is drawn from a much smaller distribution than the dictionary suggests. The entropy figure shown here is calculated from the alphabet and the length actually used, so the comparison between a passphrase and a random string is a number rather than an impression.
No. They come from crypto.getRandomValues in your own browser, are never transmitted, and are not stored — reloading the page loses them.
Roughly: 60 bits is fine for an account behind rate limiting and 2FA, 80 or more for anything valuable, and 128 is the point at which brute force stops being worth discussing. The meter reports the exact figure for your settings.
Forbidding repeats removes possible passwords from the pool, which lowers entropy slightly and caps the length at the size of your character set. It is a readability option, not a security one.