Password Generator

Entropy is calculated as log2(character-set size raised to the password length), so length is an EXPONENT in the underlying guessing-space calculation while character-set size is only the base. Adding one more character to the password multiplies the total number of possible passwords by the full character-set size, whereas expanding the character set (say, from letters-only to letters+symbols) only multiplies it by a smaller factor per character already in the password. In practice, a longer password with a smaller character set usually beats a shorter one with every character type enabled -- which is exactly why NIST SP 800-63B (the federal Digital Identity Guidelines, current within the SP 800-63-4 suite) sets a 15-character minimum for single-factor passwords and directs verifiers NOT to impose composition rules like required symbol or digit mixes.

This calculator labels 80+ bits "Very Strong" and 60-79 bits "Strong," thresholds that line up with widely cited password-strength guidance. For a critical account (email, password manager, financial login), aiming for the Very Strong tier gives meaningful headroom against both current brute-force hardware and future improvements, since each additional ~3.3 bits of entropy roughly doubles the number of guesses required.

Yes -- it draws characters using the Web Crypto API's cryptographically secure random number generator (crypto.getRandomValues), with rejection sampling to avoid any bias toward particular characters, rather than the predictable Math.random() function JavaScript uses for things like animations or non-security randomness. That makes the output suitable to actually use as a real password, not just to demonstrate entropy concepts. As with any generator, still pair it with a dedicated password manager so you aren't reusing or manually retyping passwords, and prefer a hardware security key or passkey over any generated password for your most critical accounts where that option exists.

Because the actual password is generated fresh with random character selection every time the calculator runs, even though entropy and strength are deterministic functions of length and which character sets are enabled -- the entropy BITS figure and strength label stay identical across regenerations at the same settings, only the visible password string itself changes each time.