Developer Guide
Generate Strong Passwords and Passphrases
CSPRNG passwords with a live entropy meter, a 1024-word passphrase list (10 bits per word), and look-alike exclusion. Not a password KDF and not the Random String Generator.
password123 is not a strategy. /tools/password-generator draws from crypto.getRandomValues with rejection sampling so every character in the charset is equally likely. It can also build a passphrase from a 1024-word list (10 bits per word). A meter maps estimated entropy to very weak through very strong. The page never uploads the result. It also never hashes a password for storage — that is Argon2id, bcrypt, or scrypt in your app.
Passwords: pools, length, and look-alikes
Four pools: A–Z, a–z, 0–9, and !@#$%^&*()-_=+[]{}|;:,.<>? (26 symbols). Enable them independently. If length is at least the number of enabled pools, the generator plants one character from each pool first, then fills the rest from the combined charset, then shuffles. That avoids an all-lowercase accident when you ticked “uppercase” and got unlucky.
Length is clamped to 1–128. Exclude ambiguous characters drops 0, O, I, l, and 1 so a password you read aloud is less likely to be misheard. The full four-pool alphabet is 88 characters; excluding look-alikes leaves 83.
What the strength meter is counting
Entropy is length × log2(charsetSize) for a uniform password. Sixteen characters from all 88 symbols is about 103.4 bits — the meter labels that strong (< 128 is strong; 128 and above is very strong). Twenty characters from the same set is about 129.2 bits (very strong). Thresholds: below 28 very weak, below 36 weak, below 60 fair, below 128 strong.
This is an estimate of search space, not a promise against a specific threat. A 16-character password from a 10-digit charset is only about 53 bits (fair), even though it looks long. Tick more pools or add length.
Passphrases: 1024 words, 10 bits each
The word list has 1024 English-like tokens, so each word is 10 bits (log2(1024) = 10). Six words are 60 bits (strong). Seven words are 70 bits. You can capitalize, change the separator from -, and append a digit (another ~3.3 bits). Word count is 3–12.
This is Diceware-shaped, not the EFF 7776-word list. Do not treat six words here as equivalent to six EFF words (those would be ~12.9 bits each). If you need a phrase you can type on a phone, this mode is usually easier than 20 random symbols.
Password Generator versus Random String
/tools/random-string-generator is for API keys and tokens: charset flags, no strength meter, no passphrase list. /tools/password-generator is for secrets a human might type, with entropy and look-alike exclusion. Do not mint a database password with lorem ipsum, and do not paste a passphrase into /tools/hash-generator expecting a stored verifier — SHA-256 is not a password KDF.
Use /tools/encryption-decryption when you need AES-256-GCM and a passphrase you can reuse to decrypt. Login columns still want Argon2id, bcrypt, or scrypt on the server.
CSPRNG, not Math.random
Math.random() is the wrong source for secrets. The generator throws if crypto.getRandomValues is missing. Integers are drawn with rejection sampling so they are unbiased modulo the charset length. That detail matters more than a custom “hard” character you invented.
Generate on a machine you trust, copy once, store in a password manager. Regenerating every time you forget a throwaway test account is fine. Regenerating a production database password in a cafe tab you will close without copying is how outages start.
Common pitfalls
Disabling numbers and symbols then wondering why the meter says fair. Using six short dictionary words from a 1024-list and comparing them to a 7776-word Diceware quote you read on a blog. Hashing the output with SHA-256 and storing the hex. Letting a screen share see the box.
- 88-character alphabet, 16 characters ≈ 103 bits (strong).
- 1024-word list, 6 words = 60 bits (strong on this meter).
/tools/random-string-generatorhas no entropy meter — it is for tokens.
Worked examples
Password entropy, all four pools
length 16, upper+lower+numbers+symbols (88 chars)≈ 103.4 bits — Strong20 characters from the same set crosses 128 bits (Very strong). Length 12 with only lowercase is much weaker even if it “looks random”.
Six-word passphrase
6 words from the 1024-word list, separator -60 bits — Strong (example shape: amber-field-lotus-river-stone-cloud)The words above are illustrative, not a live draw. Each draw uses getRandomValues. Capitalize or append a digit if you need extra bits you can still type.
Frequently asked questions
Is this uploaded or stored?
No. Generation runs in the browser. Closing the tab drops the string unless you copied it.
Why is my long numeric password only “fair”?
Entropy uses charset size, not length alone. Digits are 10 characters. Tick letters and symbols or switch to a passphrase.
Is the 1024-word list the same as official Diceware?
No. Official Diceware/EFF lists are 7776 words (~12.9 bits each). Here each word is 10 bits. Add a word if you are matching a Diceware bit count you read elsewhere.
Should I SHA-256 the password before storing it?
No. Store it with Argon2id, bcrypt, or scrypt in your application. /tools/hash-generator is a checksum workbench, not a KDF.
When do I use Random String instead?
For machine tokens and API keys that will never be typed. Use this page when a human has to remember or transcribe the secret.
Summary
Draw passwords from a CSPRNG with all four pools, or a passphrase from the 1024-word list, and read the meter as search-space bits rather than a vibe. /tools/password-generator stays in the tab. Put the result in a manager, hash it with a real KDF if it is a login, and use /tools/random-string-generator when the consumer is a machine.