Two things decide whether a generator is any good, and you cannot see either
Every generator produces a string of characters that looks random. Whether it is random is a property of the code, not of the output, and there is no way to tell by looking.
1. Where the randomness comes from
A great many free generators use Math.random. It is fast, it is fine for shuffling a playlist, and it is not cryptographically secure: the internal state is small and it was never designed to resist somebody trying to predict it.
Browsers have had crypto.getRandomValues for well over a decade. It draws from the operating system's own entropy pool and it is one line of difference. That is what this uses.
2. Modulo bias, which is invisible
The obvious way to choose a character is to take a random byte and divide by the alphabet size, keeping the remainder. With 62 characters that is a problem, because 256 is not a multiple of 62:
256 = 4 x 62 + 8Bytes 0 to 7 map to the first eight characters one extra time each, so those eight appear about 1.5% more often than the other 54. No password will ever look wrong, and no user will ever notice, but the distribution is skewed and the real entropy is lower than the number the tool is displaying.
The fix is rejection sampling: throw away any byte at or above the last exact multiple and draw again. It costs a handful of extra bytes and it is the difference between a generator that is uniform and one that only claims to be.
"Six words" is advice about a list you are probably not using
A passphrase is worth words x log2(list size) bits. That second term is the whole argument, and almost no generator tells you what its list size is.
- Diceware, 7,776 words: 12.9 bits per word, so six words is 77 bits.
- This list, 512 words: exactly 9 bits per word, so six words is 54 bits.
Both are "six words". One is 8,000 times stronger than the other. Repeating the familiar advice next to a smaller list hands somebody a passphrase a fraction as strong as they believe it to be, so the size is stated here, the bits are calculated from it, and the default is set for this list rather than borrowed.
Length beats variety, by a long way
Adding one character to a mixed-case alphanumeric password is worth about six bits. Switching symbols on, for a password of a fixed length, gains around four bits in total.
So a longer password from a simpler alphabet beats a short one full of punctuation, and it is easier to type and less likely to be rejected. The symbol tick box is there because some systems demand one, not because it is where the strength comes from.
What is protecting a four digit PIN
Four digits is 13 bits: ten thousand possibilities, which software exhausts instantly. A cash machine is safe not because the PIN is strong but because it swallows the card after three attempts.
That distinction is worth holding on to, because it applies everywhere. A password's real safety depends as much on how the far end stores and rate-limits it as on the password itself, which is also why nobody can honestly tell you how long yours would take to crack.
Where to keep them
In a password manager, and there are good free ones. The only passwords worth memorising are the two you cannot store in it: your device login and the manager's own master password. Those two are the ones to make passphrases.
Everything here is generated on your own machine and never sent anywhere. Reloading the page loses them.
Common questions
Are these passwords sent anywhere?
No. They are made in your browser by your own operating system's random number source and never leave the machine. There is no server involved, nothing is logged, and reloading the page loses them, so copy the one you want before you go.
What is wrong with Math.random?
It is a fast pseudo-random sequence with a small internal state, and it was never designed to resist somebody working out what it will produce next. A great many free generators use it anyway. Browsers have had crypto.getRandomValues for years, which draws from the operating system, and that is what this uses.
What is modulo bias?
The obvious way to pick a character is a random byte divided by the alphabet size, taking the remainder. With 62 characters, 256 does not divide evenly, so the first nine characters come up about 1.5% more often than the rest. Nothing about the output looks wrong and it never will, but the distribution is skewed and the real strength is lower than the number shown. The fix is to throw away any byte in the uneven tail and draw again, which is what happens here.
How many bits do I actually need?
Under 40 bits is weak against anything. Around 60 is fine for a site that limits login attempts. Above 80 is beyond reach for offline cracking of a properly stored password for the foreseeable future. Those numbers move slowly, unlike crack-time estimates, which is why this tool gives bits rather than "it would take 4 billion years".
Why does it not tell me how long a password would take to crack?
Because every such figure rests on a guessed number of attempts per second, and that guess moves with hardware and depends entirely on how the site stored the password in the first place. The same password is instant against an unsalted MD5 hash and impractical against a properly configured one. Bits are the honest measure and they do not go stale.
How many words should a passphrase be?
On this list, eight or nine. The familiar advice that six words is plenty is advice about Diceware, whose list holds 7,776 words and so contributes 12.9 bits each. This list holds 512 words, which is exactly 9 bits each, so six words is 54 bits rather than 77. The tool states the list size and works the bits out from it rather than borrowing somebody else's number.
Is a passphrase better than a password?
It is easier to type on a phone, easier to read off a screen, and much easier to remember, which matters for the handful you cannot store in a manager: your device login and the password manager's own master password. For everything else, length wins, and a random 20 character password you never type is stronger per character.
Why are quotes and backslashes missing from the symbols?
Because they break things. A quote inside a command line, a CSV file or an SQL statement causes trouble somewhere between your keyboard and the database, and the failure is usually silent. Leaving four characters out costs a fraction of a bit and saves a genuinely annoying afternoon.
A site rejected my generated password.
Usually the symbols. Plenty of systems quietly strip them, and some silently truncate a long password rather than saying it is too long, which means the password you set is not the one you think you set. If a site imposes a low maximum length, that is a strong sign it is storing passwords in a way it should not be.