Password generator

Entropy is length × log₂(alphabet size), measured in bits. With all four character types the alphabet has 90 characters, so a 16-character password has 16 × 6.49 ≈ 104 bits. Each extra bit doubles the number of guesses an attacker needs, which is why length matters more than any single symbol.

Weak is under 40 bits, Fair under 60, Strong under 80 and Very strong 80 bits or more. Around 60 bits resists online guessing comfortably; 80 bits or more holds up against offline attacks on stolen password databases. The labels assume the password is random, not a dictionary word with substitutions.

The estimate assumes an attacker trying 10 billion guesses per second, roughly a strong GPU rig against a fast hash, and needing on average half of all possible combinations. Real speeds vary enormously: a slow hash such as bcrypt makes it far longer, while a leaked plaintext password makes it zero.

Yes. One character is drawn from each selected type first, the rest are drawn from the combined alphabet, and the result is shuffled. That guarantees the password passes rules such as "at least one digit and one symbol" without making any position predictable, even at the minimum length of four.

This page runs entirely in your browser using crypto.getRandomValues; nothing is sent to a server or stored. Even so, the safest habit is to paste the password straight into a password manager, use a different password for every account and turn on two-factor authentication wherever it is offered.