Password Generator

Live entropy vs strength-band board with a charset peel and length ladder. Passwords are drawn locally with a CSPRNG; Share links sync policy flags only.

Security literacy only. Not a password manager or vault. Toy crack-time sketches are not real attack models. Never put secrets in URLs, chat, or tickets.

By Ahmet C. Toplutaş·Site owner & editor · Technology tools

Last updated May 21, 2026 · Reviewed May 21, 2026 · Planning estimates only - not tax, medical, or investment advice

Entropy budget vs character policy

A strong random password is less about clever keyboard patterns and more about how large the search space is. Length multiplies pool size. Character classes and filters (ambiguous glyphs, brackets, no-repeat) change that pool before any string is drawn.

This page’s framing is an entropy vs strength-band twin, with a charset peel, a length ladder, and policy-only Share links so secrets never land in the address bar. It is not download-time clocks, not SI/IEC data-size ladders, and not Ohm’s power twin.

Decision framing: “For this charset and length, roughly how many bits of entropy am I sketching, and does a longer length on the same pool move the band?”

Security literacy only. Not a password manager, vault, SSO product, or breach monitor. Store secrets in a reputable manager; never paste them into chat, tickets, or shared URLs. See our disclaimers.

Charset peel

The peel counts how many lowercase, uppercase, digit, and symbol glyphs remain after filters, then the combined unique pool. Ambiguous exclusions shrink the pool on purpose (easier to read, slightly fewer bits per character).

Toggle Exclude ambiguous on Everyday 16, then off. Watch pool size and entropy move while length stays fixed.

The toy crack-time line is a fantasy guess-rate sketch only. Real attacks use leaked password lists, throttling, and hash specifics. Do not treat it as a guarantee.

Length ladder on a fixed pool

Keep the character pool fixed and compare entropy at 8, 12, 16, 20, and 24 characters. Tap a rung to set length and regenerate locally. Length is usually the cheapest way to raise bits once classes are already enabled.

Local CSPRNG, not Math.random

Generation uses crypto.getRandomValues with rejection sampling for uniform picks, then shuffles class-guarantee seeds into the final string. Nothing is sent to a server to create the password. Share syncs policy flags only.

What the panel actually computes

Ideal random-string entropy under a fixed pool (educational).

pool = unique chars after class + filter rules entropy_bits ≈ length × log2(pool_size) band = map(entropy_bits) → weak / modest / solid / strong toy_seconds ≈ 2^(bits−1) / 1e12 (not a real attack model)

Where this hands off

After generating a secret, hand off for other technology literacy tools. Account recovery, MFA, and breach response live outside this board.

SI vs IEC sizes: data size converter
Transfer clocks: download time
Base literacy: binary / hex converter
Bandwidth cost sketch: bandwidth to cost

Worked scenarios

Scenario A: Everyday 16. All classes, ambiguous off. Entropy lands in a solid/strong neighborhood for many personal accounts; still store it in a manager.

Tap the length ladder down to 8, then back to 16. Same pool, very different bits.

Scenario B: Alphanumeric 20. No symbols when a site rejects them; length compensates for a smaller pool.

Scenario C: High entropy 24. Full pool, long string. High-entropy narrative; still not a substitute for MFA on important accounts.

Scenario D: PIN sketch. Six digits only. Intentionally weak demo so the band and toy crack line look scary on purpose.

Common mistakes

Reusing one “strong” password across sites.
Putting the generated secret into a Share URL, email, or ticket.
Trusting the toy crack-time line as a real attacker model.
Using Math.random-era generators (this board does not).
Expecting this page to replace a password manager or MFA.
Confusing it with download time or data size tools.

How to use this panel

Load a preset or set length and character classes.
Optional: exclude ambiguous glyphs, brackets, or repeats.
Read entropy, band, charset peel, and length ladder; regenerate as needed.
Copy the password locally. Share only if you want policy flags in the URL; the secret is never written there.

When not to stop at a generated string

Stop here for local random generation literacy. Hand off for data-size, download, or base tools when the question is not passwords. For account security, add MFA, unique secrets per site, and a manager that stores and autofills safely.

Data size: data size.
Download time: download time.
Bases: binary / hex.

Frequently asked questions

How does this password generator work?

It builds a character pool from the classes you enable, filters ambiguous or bracket characters if asked, estimates entropy as length × log2(pool size), and generates passwords in your browser with a CSPRNG (crypto.getRandomValues). Share links store policy only, never the secret.

What is the entropy twin?

Entropy bits estimate how large the search space is under an ideal random draw from your pool. The strength band maps those bits into weak / modest / solid / strong sketches. It is literacy, not a lab grade of your account risk.

What is the length ladder?

It keeps your character pool fixed and shows entropy at 8, 12, 16, 20, and 24 characters so length’s effect is visible without regenerating secrets each time.

Is the crack-time number real?

No. It is a toy sketch at a fixed fantasy guess rate. Real attacks use leaked password lists, targeted guessing, throttling, and offline hash specifics. Do not treat it as a security guarantee.

Are passwords put in the URL?

No. Share / Copy link writes length and charset policy flags only. The generated password stays in page memory until you copy it yourself.

Is this a password manager?

No. It does not store, sync, autofill, or audit reused passwords. Prefer a reputable password manager for long-term secrets. This page is generation literacy.

How is this different from download time or data-size tools?

Download time estimates transfer clocks. Data size converts SI vs IEC units. This page is password policy entropy and local CSPRNG generation.

Sources

Loading…

Entropy budget vs character policy

Decision framing: “For this charset and length, roughly how many bits of entropy am I sketching, and does a longer length on the same pool move the band?”

Security literacy only. Not a password manager, vault, SSO product, or breach monitor. Store secrets in a reputable manager; never paste them into chat, tickets, or shared URLs. See our disclaimers.

Charset peel

Toggle Exclude ambiguous on Everyday 16, then off. Watch pool size and entropy move while length stays fixed.

The toy crack-time line is a fantasy guess-rate sketch only. Real attacks use leaked password lists, throttling, and hash specifics. Do not treat it as a guarantee.

Worked scenarios

Scenario A: Everyday 16. All classes, ambiguous off. Entropy lands in a solid/strong neighborhood for many personal accounts; still store it in a manager.

Tap the length ladder down to 8, then back to 16. Same pool, very different bits.

Scenario B: Alphanumeric 20. No symbols when a site rejects them; length compensates for a smaller pool.

Scenario C: High entropy 24. Full pool, long string. High-entropy narrative; still not a substitute for MFA on important accounts.

Scenario D: PIN sketch. Six digits only. Intentionally weak demo so the band and toy crack line look scary on purpose.

Common mistakes

Reusing one “strong” password across sites.
Putting the generated secret into a Share URL, email, or ticket.
Trusting the toy crack-time line as a real attacker model.
Using Math.random-era generators (this board does not).
Expecting this page to replace a password manager or MFA.
Confusing it with download time or data size tools.

When not to stop at a generated string

Data size: data size.
Download time: download time.
Bases: binary / hex.

Frequently asked questions

How does this password generator work?

What is the entropy twin?

What is the length ladder?

It keeps your character pool fixed and shows entropy at 8, 12, 16, 20, and 24 characters so length’s effect is visible without regenerating secrets each time.

Is the crack-time number real?

No. It is a toy sketch at a fixed fantasy guess rate. Real attacks use leaked password lists, targeted guessing, throttling, and offline hash specifics. Do not treat it as a security guarantee.

Are passwords put in the URL?

No. Share / Copy link writes length and charset policy flags only. The generated password stays in page memory until you copy it yourself.

Is this a password manager?

No. It does not store, sync, autofill, or audit reused passwords. Prefer a reputable password manager for long-term secrets. This page is generation literacy.

How is this different from download time or data-size tools?

Download time estimates transfer clocks. Data size converts SI vs IEC units. This page is password policy entropy and local CSPRNG generation.

Entropy budget vs character policy

Charset peel

Length ladder on a fixed pool

Local CSPRNG, not Math.random

What the panel actually computes

Where this hands off

Worked scenarios

Common mistakes

How to use this panel

When not to stop at a generated string

Frequently asked questions

How does this password generator work?

What is the entropy twin?

What is the length ladder?

Is the crack-time number real?

Are passwords put in the URL?

Is this a password manager?

How is this different from download time or data-size tools?

Sources

Entropy budget vs character policy

Charset peel

Length ladder on a fixed pool

Local CSPRNG, not Math.random

What the panel actually computes

Where this hands off

Worked scenarios

Common mistakes

How to use this panel

When not to stop at a generated string

Frequently asked questions

How does this password generator work?

What is the entropy twin?

What is the length ladder?

Is the crack-time number real?

Are passwords put in the URL?

Is this a password manager?

How is this different from download time or data-size tools?

Sources

What this number means

Share your calculation