How this is calculated
Each character is drawn independently and uniformly from your selected alphabet using crypto.getRandomValues, with rejection sampling to avoid the modulo bias that would otherwise make some characters marginally more likely than others.
Strength is measured in bits of entropy: log₂(alphabet size) × length. A 16-character password from the 94 printable ASCII characters carries about 105 bits. A 16-character lowercase-only password carries about 75 bits — still substantial, but a trillion times weaker.
Each additional bit doubles the search space. That is why the comparison between password schemes is best made in bits rather than in vague labels like 'strong', which convey nothing about the actual margin.
Length beats complexity
Adding one character to a password multiplies the search space by the size of the alphabet — for mixed-case letters and digits, by 62. Adding symbols to a fixed-length password multiplies it by a much smaller factor, because it only widens the alphabet from 62 to 94.
A 20-character password using only lowercase letters carries about 94 bits, comfortably more than a 12-character password using every symbol on the keyboard, which carries about 79. Length is the more efficient lever, and it produces passwords that are easier to type when you have to.
This is why the old advice about substituting characters — replacing letters with lookalike symbols — is largely useless. Those substitutions are well known to cracking tools, add almost no entropy, and make the password considerably harder to type.
Where a generated password should live
In a password manager. A genuinely random 16-character password is not memorable, and any scheme that makes it memorable removes most of the randomness that made it strong.
Reuse is the failure mode that actually matters. Credential stuffing takes passwords exposed in one breach and tries them elsewhere, and it works because reuse is common — not because any individual password was weak. A unique generated password per site makes a breach at one service irrelevant to every other.
Two-factor authentication remains worth enabling regardless of password strength, because it defends against the cases a strong password cannot: phishing, a compromised device, and a breach at the service itself.
How to use the password generator
- Choose a length. 16 characters or more for anything that matters. Length raises entropy faster than adding symbols does.
- Select the character sets. Include symbols unless the site rejects them. Some services still impose limits that force a narrower alphabet.
- Store it in a password manager. Do not try to remember it. A unique password per site is what actually defends against credential stuffing.