Password Generator

Password strength mostly comes down to how many possible passwords an attacker would have to guess before finding the right one — a property called entropy. Length contributes far more to this than character variety does: adding four more characters to a password increases the guessing space more than adding symbols to a shorter one. That's why a longer password using just letters and numbers can be stronger than a short one packed with symbols.

The other factor that matters is unpredictability. A password generated by a genuine random process, like this tool's, has no pattern an attacker could exploit — unlike a password a person chooses by hand, which tends to follow patterns (real words, predictable substitutions, personal details) that make it easier to guess than its length alone would suggest.

Each character is selected using the Web Crypto API's crypto.getRandomValues(), not Math.random(). To avoid a subtle statistical bias that a naive implementation would introduce — where some characters would be selected very slightly more often than others — this tool uses rejection sampling: it draws a random value and discards it if it falls in a range that wouldn't map evenly onto the character set, then draws again.

If you've enabled multiple character types, one character from each enabled type is drawn first to guarantee it appears, and the rest of the password is filled from the full combined set. The whole result is then shuffled using a Fisher-Yates shuffle — also driven by the same secure randomness — so the guaranteed characters don't end up predictably placed at the start.