Developer & Tech

Secure Password Generator

What this does

Build random passwords from selectable character classes with guaranteed coverage, ambiguity filtering and entropy estimates.

Enter your details

Runs in your browser

Calculator inputs

How to use it

Using the secure password generator

  1. 01

    Match the site policy

    Toggle classes until the recipe satisfies whatever rules the signup form enforces.

  2. 02

    Consider ambiguous chars

    Exclude l/1/I/O/0 when passwords will be read aloud or transcribed by hand.

  3. 03

    Copy and store it

    Paste straight into your password manager; never reuse it elsewhere.

Good to know

Length beats cleverness

Each added character multiplies search space by the pool size; going from 12 to 16 characters over a 62-symbol pool adds roughly 24 bits of entropy, dwarfing any symbol-substitution trickery. When in doubt, make it longer, not weirder.

Why guaranteed-class draws then shuffle

Pure rejection sampling (“regenerate until it contains a digit”) wastes iterations; drawing one per class then shuffling satisfies constraints deterministically while keeping the remainder uniform. Shuffling ensures the guaranteed draws are indistinguishable by position.

How it's calculated

The math behind this calculator

entropy bits = length × log₂(pool size); pool = union of enabled character classes

One character is drawn from every enabled class first; guaranteeing each policy requirement is met; then the remaining slots fill uniformly from the combined pool and the whole sequence is shuffled so position never leaks which slot held the guarantee draw.

Entropy is estimated as length × log₂ of the combined pool size, with a verdict band translating bits into practical strength terms. Excluding visually ambiguous characters (l, 1, I, O, 0) shrinks the pool slightly and the estimate reflects that honestly.

Assumptions & limitations

  • Randomness sourced from the platform CSPRNG.
  • Entropy math assumes uniform random selection over the pool.
  • Policies requiring specific placement rules (digit-first etc.) are not modeled.

Worked example

A 16-character recipe over lower+upper+digits pools 62 possible characters; roughly 95 bits of entropy, comfortably strong for any login.

FAQ

Frequently asked questions

Are generated passwords stored or transmitted?
No. Generation happens locally in your browser with the platform’s secure random source; nothing is logged or sent anywhere.
Why does the summary differ from the actual password?
Passwords are freshly randomized each run; the headline describes the deterministic recipe (length and classes) while the concrete secret sits in the results panel.
Is excluding ambiguous characters safe?
It removes five characters from consideration, trimming entropy marginally; a fine trade when humans must type the password accurately.
Should symbols always be enabled?
Only if the target system accepts them and you will paste rather than type. Length contributes far more strength than symbol inclusion.

Keep exploring

Related calculators