Memorability is how accounts get reused
Use this when you are about to create an account, a password manager is open, and you want a string from the browser CSPRNG instead of a slogan. The unique failure is not a “weak generator.” It is making something cute enough to remember, then reusing it on three sites because two 16-character strings feel rude. Length beats cleverness. Random beats a pet name with a 4 at the end. This UI is character classes, a length slider from 4 to 128 (default 16), and a count up to 20.
Bytes should come from Web Crypto’s crypto.getRandomValues, not from Math.random. Open View source and search for getRandomValues before you trust a string that will sit in a vault for five years. The strength meter is a heuristic (length, classes, a slap on repeated characters). It is not entropy. A 12-character all-lowercase string can look “medium” on a bar and still be a weekend for a GPU.
Worked example: default 16, four classes
Leave length at 16. Keep uppercase, lowercase, digits, and symbols. The mixed alphabet is about 94 symbols. Rough entropy is 16 × log2(94) ≈ 105 bits. That is a website password, not a disk-encryption key, and it is already more than most humans will type accurately. Copy it into Bitwarden, 1Password, or the manager you already pay for. Do not paste it into a spreadsheet named passwords.xlsx on a shared Drive. The generator’s job ended at “here is a string.” Storage is the manager’s job.
Worked example: 8 lowercase, the movie password
Set length to 8. Uncheck everything except lowercase. 26^8 is about 2.09×10^11 candidates. Offline cracking on one modern GPU eats that if the site stored it badly; online, rate limits help until they do not. I still see this pattern because “the site required 8 characters.” If a field caps you at 8, use all four classes and treat the site as the weak point. Prefer 16 when the field allows it. Prefer 20+ for anything that unlocks money or email. Adding symbols to an 8-character string is a worse trade than adding eight more random characters.
Worked example: 24 characters, skip 0/O/l/1
You must read the password off a phone onto a TV once, then save it. Length 24, all classes, “skip similar” on so 0/O/l/I/1 drop out. You lost a handful of symbols and gained a lot of length. That trade is correct. The exclude-ambiguous braces option exists for the same reason: humans mis-copy {}[]() from a projector. Machines do not care. After the TV dance, the string still belongs in the manager, not in a photo of the screen. Generate a second 24-character string if the first one has three punctuation marks in a row and you know you will mistype it.
What this will not do
It will not check Have I Been Pwned. It will not emit Diceware word lists. It will not refuse a 4-character toy string if you drag the slider there — the floor is 4 because fixtures exist, not because 4 is a password. The count field makes up to 20 strings; it will not bulk-fill a 10,000-row dump. Reuse across sites is still on you. A manager’s own generator is fine. This page exists so you are not pasting “generate password” into a search box that also wants an email gate.
Questions
Where do the random bytes come from?
Web Crypto getRandomValues (a CSPRNG). Open View source and search for getRandomValues before you store the string for years.
16 characters enough?
For a website login stored in a manager, yes if you use a full charset. Prefer 20+ for email, banking, or anything that resets other accounts.
Should I memorize it?
No. Length beats memorability. Save it in a password manager and let the manager fill the field.
Why skip 0/O/l/1?
Humans confuse them on a projector. Machines do not. Turn the option on only when a person has to retype the string.
Can I reuse one strong password everywhere?
No. One breach then becomes every account. Unique string per site; the manager is how that stays sane.
Does this check leaked passwords?
No. It will happily emit a random string that has never been seen. Have I Been Pwned is a different tool.