Password Generator

What Makes a Strong Password A strong password has enough length and randomness that brute-force guessing is impractical. Each additional character multiplies the number of possible combinations exponentially. A 16-character password from this generator’s 88-character set has 88^16 combinations, which is about 1.29 × 10^31.

Character Sets and Entropy Entropy measures the randomness of a password in bits. Each bit of entropy doubles the number of possibilities. A fully random password’s entropy = length × log2(character set size). A 12-character password from the full 88-character set carries about 77.5 bits. Security experts recommend at least 60 bits for standard accounts and 80 or more for anything sensitive.

Why 88 characters and not 95 Printable ASCII has 95 characters. This generator uses 88 of them: 26 lowercase, 26 uppercase, 10 digits, and 26 symbols. The seven left out are the space, the double quote, the single quote, the forward slash, the backslash, the backtick, and the tilde.

They are excluded because they cause trouble downstream rather than because they are weak. Quotes and backslashes break naive form handling and shell commands, slashes get mangled in URLs and file paths, and a leading or trailing space is invisible in a password field and impossible to debug. Dropping them costs you about 0.11 bits per character, which on a 16-character password is under 2 bits. Length buys that back instantly: one extra character is worth 6.5 bits.

Recommended Lengths For general accounts, 12 to 16 characters of mixed types is strong. For banking and email, go to 16 or 20. A password manager will happily store any length, so there is no practical reason to keep them short. This generator draws from crypto.getRandomValues(), the browser’s cryptographic random source, not from Math.random(), which is predictable and must never be used for anything you are protecting.