Strong password generator

How it works

Every character comes from crypto.getRandomValues() — your browser's cryptographically secure random source, the same one used by password managers, not Math.random(). The strength meter estimates entropy in bits directly from the length and the size of the character pool you've enabled.

FAQ

Is this actually secure, or just random-looking?

It's genuinely cryptographically random. crypto.getRandomValues() draws from your operating system's secure entropy source, not a predictable pseudo-random algorithm.

Why does turning off symbols lower the strength score at the same length?

Removing a character set shrinks the pool each character is drawn from, which reduces entropy even though the password length hasn't changed.