Each character is drawn from window.crypto.getRandomValues — the browser's cryptographically secure random source, the same one used for TLS session keys. That is far stronger than Math.random and matches the entropy expected by password managers and security audits.

For most accounts a 16-character password with uppercase, lowercase, numbers and symbols comfortably exceeds 80 bits of entropy and resists offline cracking. Vault master passwords and root credentials benefit from 24+ characters; throwaway burner accounts can use fewer.

Strength is estimated as length × log₂(character pool size), expressed in bits. Anything above ~80 bits is considered safe against offline brute force for the foreseeable future. Removing character classes shrinks the pool, so the bit count drops accordingly.

In theory yes, but the probability is astronomically small for any reasonable length. A 16-character mixed-class password has roughly 10^31 possible values — the chance of accidental collision is far smaller than the chance of a hardware failure.

Enable "Exclude similar" (i, l, 1, L, o, 0, O) when the password will be transcribed by hand or read over the phone to avoid mix-ups. Enable "Exclude ambiguous" ({} [] () /\ '"`,;:.) when the password must paste cleanly into terminals or shell scripts.

No. Generation happens entirely on your device and recent passwords live in memory until you reload the tab. Nothing is sent over the network, nothing is logged and nothing is cached.

Yes. Turn on "Exclude similar" to drop the characters that get confused on screen or over the phone (i, l, 1, L, o, 0, O), and turn on "Exclude ambiguous" to drop brackets, slashes and quotes that are awkward to type. Then raise the length a few characters to keep the entropy where you want it.

Switch the mode toggle from 'Random characters' to 'Passphrase (words)' — the generator then builds a password from several random dictionary words (EFF Diceware wordlist) instead of scrambled characters, which is easier to remember and type but still cryptographically strong.

The default of 6 words gives roughly 77 bits of entropy, the EFF-recommended minimum for a strong passphrase. Drag the Words slider higher (up to the maximum) for a master password protecting a password manager or crypto wallet, or lower for a passphrase you'll type frequently on a low-risk account.

Yes. The Separator dropdown lets you pick a hyphen, dot, underscore, space, or no separator at all. A hyphen or dot is usually easiest to type accurately on both desktop and mobile keyboards, while some login forms reject spaces in passwords.

Turn on 'Capitalize each word' if a site requires an uppercase character, and 'Append a number' if it requires a digit — many login forms enforce these composition rules even for long passphrases. Both options add negligible extra memorization effort while satisfying stricter password policies.

Use Passphrase mode with 7-8 words, a hyphen or dot separator for easy retyping, capitalize each word on, and append a number on — this comfortably clears 90+ bits of entropy while staying far easier to memorize and type accurately than an equivalent-strength random-character password.

The Length slider in Random characters mode runs from 8 up to 128 characters, matching the 'up to 128 characters' promise in the tool's title. For most logins 16-20 characters is plenty; push toward 128 only for systems that specifically call for an extremely long secret, like certain API tokens or hardware security modules.

The Words slider in Passphrase mode ranges from 3 words (shorter, lower entropy) to 12 words (extremely high entropy, well over 150 bits). The default of 6 words balances memorability with the EFF-recommended ~77-bit minimum for a strong passphrase.

The Regenerate button disables and the password field clears, with a hint reading 'Pick at least one character class to enable generation.' At least one of Uppercase, Lowercase, Numbers or Symbols must stay checked, since the generator needs a character pool to draw from.

Yes — switch to Passphrase mode to get random words joined by a separator, optionally capitalized and with a number appended (the xkcd style). A four-to-five word passphrase from the memorable password generator is far easier to remember than a string like 'xK9#f2' yet still strong, because its entropy comes from the size of the word list.

Yes — generate and copy as many passwords as you need with no account. Everything runs in your browser using window.crypto, so generated passwords never leave your device and recent ones are cleared from memory when you reload the page.

Password Generator does not take a file. It works from the length and character options you choose. If nothing is generated, check that the fields on the page are filled in and, where a link is needed, that the whole link was pasted.

Yes — adjust the inputs and generate again as many times as you need; nothing is locked in until you download. Check the result at the size it will actually be used, because something that reads clearly on screen can fail once it is printed small or shown on a phone.

Password Generator shows its result on the page. Standard use does not require signup; this workflow does not offer a file download. Published processing allowances and file limits still apply.

No — Password Generator runs in the browser on desktop and phone. There is nothing to install, no trial to start, and no license to buy before you can see whether it does what you need. Try it on the file you are actually stuck with rather than a sample.

The generator makes a new password every time you move the slider or tick a box, so the result always matches the settings on screen. Set the options first, then copy the final password. Select Generate my password if you want another one with the same settings.

Yes. Each ticked type, such as uppercase, lowercase, numbers or symbols, contributes at least one character, and the rest are drawn from the combined pool before the order is shuffled. Exclusions apply first, so a character you excluded never appears.

The symbol set is fixed at 27 punctuation marks, including brackets, braces, a slash, the exclamation mark and the usual @ # $ % ^ & * group. You cannot type your own set. If a site rejects some of them, switch on Exclude ambiguous to keep only the exclamation mark, @ # $ % ^ & * - _ = + and ?, or untick Symbols.

Very little. It adds one digit, about 3 bits, while each extra word adds about 13 bits. If you want a stronger passphrase, raise Words by one or two rather than relying on the number. Keep the number only when a site insists on a digit.