Password generator

A password is 6 to 64 characters long; the slider stops at both ends. Each character on screen is coloured by its type. Every character is drawn with crypto.getRandomValues, the operating system's cryptographic random source. Math.random is not used anywhere on this page. To pick one of n characters the page takes a 32-bit number and throws it away if it lands in the short tail above the largest exact multiple of n, then draws again. That rejection sampling is what keeps the modulo from making the first few characters of a set slightly more likely than the rest.

One character is taken from each selected type first, so a password that says it contains digits actually contains one. The remaining places are filled from the combined pool, and the whole thing is shuffled with a Fisher–Yates pass using the same unbiased draw. That guarantee makes the draw uneven: a character from a smaller set is likelier in any given place — at the defaults each digit has about a 1.9% chance per place, each letter about 1.6% — and some passwords come out more often than others.

The bits printed are the Shannon entropy of that exact process. At length L with k types chosen, a password holding c characters of each type, drawn from a set of s, comes out with probability Π(c ÷ s) × (L−k)! ÷ L! ÷ pool^(L−k), the product running over the chosen types. The page walks every mix of counts, sums −p log2 p and prints the result to one decimal. That is below length × log2(pool size) by 1.8 bits at 6 characters with all four types, 1.1 at 8 and 0.3 at 16, and equal to it when only one type is picked. The grade is a plain cut at 50 and 80 bits on the printed figure. That number describes the process, not the string: it is only true because the characters were machine-drawn. It is not a strength estimate for a password you invented yourself — paste one into the same formula and it will lie to you.

Symbols are off by default because some login forms still reject them, and the symbol set here is !@#$%^&*()-_=+[]{};:,.?/ — no quotes, no backslash, no space, since those are the characters that most often break a form or a shell command.

This tool refuses to store, transmit or remember anything. There is no server in this file, no history, and no storage of any kind: a password you do not copy is gone the moment you generate the next one or close the tab. It also will not tell you whether a password you already have is any good — checking that honestly means knowing where it came from, and this page cannot know that.

The Dark button remembers its setting in this browser's local storage. Nothing you type or drop into the page is stored.