How the passwords are made
Each character is picked independently and uniformly from the pool of characters you allow. The randomness comes from the browser's cryptographic generator, crypto.getRandomValues, which draws on the operating system's entropy source.
One detail matters more than it looks. A random 32-bit number reduced with a remainder operation is slightly biased toward the first characters of the pool, because 2³² is not an exact multiple of the pool size. The generator discards the few values that would cause that bias and draws again, so every character really has the same chance.
The pools are:
- Lowercase
a-z: 26 characters. - Uppercase
A-Z: 26 characters. - Digits
0-9: 10 characters. - Symbols: 27 characters,
!@#$%^&*()-_=+[]{};:,.<>?/~.
With everything enabled the pool has 89 characters. The "no ambiguous" option removes I, l, 1, O and 0, leaving 84.
Passwords exist only in the page. Changing any option instantly produces a new set, and nothing is saved or sent.
Reading the entropy figure
Entropy is the number of bits an attacker has to guess. For a random password it is the length multiplied by log₂ of the pool size. Every extra bit doubles the work.
Some concrete values from the meter:
- 4 digits, a PIN: 13 bits.
- 8 lowercase letters: 38 bits, rated Weak.
- 12 characters from all sets: 78 bits, Strong.
- 16 characters from all sets: 104 bits, Excellent.
- 20 characters from all sets: 130 bits.
The labels change at 40, 64 and 100 bits. To put those in perspective, assume an attacker who has stolen a password database and can test 10 billion guesses a second against a fast hash. A 40-bit password falls in under two minutes on average. A 64-bit one takes decades. An 80-bit one takes over a million years.
Length is worth more than variety. Adding symbols to a 16-character password raises the pool from 62 to 89 characters and gains about 8 bits; adding four more characters to the same password gains about 26 bits.
The figure assumes the password was generated randomly, which is true here. It says nothing about passwords you invent yourself, where patterns, names and dates make real-world entropy far lower.
When a site rejects the password
Characters are chosen independently, so a password is not guaranteed to contain at least one of each enabled type. With all four sets on, a 16-character password has no digit about 15% of the time; missing an uppercase letter or a symbol happens in well under 1% of cases. If a site insists on a digit, simply pick another password from a batch: set "How many" to 5 or 10 and take one that satisfies the rules.
Other common rejections:
- Too long. Some banking and legacy systems cap length at 12, 16 or 20 characters. Shorten the slider to fit.
- Forbidden symbols. Characters like
<,>,;or/are sometimes blocked. Generate a few and pick one without them, or switch symbols off and add 3 to 4 characters of length to make up the lost entropy. - Typed by hand. For Wi-Fi keys or codes you read aloud or type on a TV remote, turn on "no ambiguous" and consider leaving out symbols.
Using generated passwords well
A strong password helps only if each one is unique. Reuse is what turns one leaked site into access to your email and bank.
- Store generated passwords in a password manager rather than a text file or a note app.
- Use 20 or more characters for the master password and the email account, since they unlock everything else.
- Copied text may stay in the clipboard history on your device; clear it if others use the same computer.
- For a password you need to share, such as one protecting an archive made with create ZIP, send it through a different channel than the file itself.
If you need to pass a Wi-Fi password to guests, a printed code from the QR code generator saves anyone from typing it.