Password Generator with Entropy Strength Meter

Strong password generator

This password generator builds random passwords in your browser using the cryptographic random source that browsers expose to web pages. You set the length and pick which character types to include, and each result comes with an entropy-based strength estimate. Nothing you generate is sent anywhere.

How passwords are generated

You choose a length from 8 to 64 characters and switch four character sets on or off: uppercase (A-Z), lowercase (a-z), numbers (0-9), and symbols. The generator reads random values from window.crypto.getRandomValues and guarantees at least one character from every set you enable. Two presets fill in sensible defaults: Standard uses 20 characters with letters and numbers, and Military uses 32 characters with symbols added.

How the strength meter works

Strength is reported as Shannon entropy: the length multiplied by the base-2 logarithm of the pool size. The pool is the count of characters the password could contain, so turning on more sets and increasing the length both raise entropy. The meter maps the number to a crack-time label of Instant, Years, or Centuries.

entropy (bits) = length × log2(pool size)
pool size = uppercase 26 + lowercase 26 + numbers 10 + symbols 30

Worked example

A 20-character password using uppercase, lowercase, and numbers draws from a pool of 62 characters, giving 20 × log2(62), or about 119 bits of entropy. Switching to the Military preset of 32 characters with symbols added widens the pool to 92 and raises entropy to roughly 209 bits.

What it does not protect against

A strong password is only one layer of account security. This tool does not store or manage passwords, cannot stop phishing, keyloggers, or a breach of the service where you use the password, and cannot help if you reuse the same password across sites. The crack-time label reflects resistance to brute-force guessing only, assuming an attacker who already knows which character sets were used.