Password Generator

The generator builds a pool from the boxes you tick, then picks every character from that pool at random. The default is 16 characters with all four boxes ticked. These are the figures for 16 characters with this tool's actual character sets:

The pool is 26 lowercase letters, 26 capitals, 10 digits and 25 symbols. If you untick everything, the tool falls back to lowercase letters, so you never get an empty result.

A password is made once when the page loads. Moving the length slider or ticking a box doesn't change it. Press Generate new password after adjusting the options, then use the copy button next to the field. Retyping a long random password by hand invites typos.

Every character comes from crypto.getRandomValues, the browser's cryptographic random source, and the password exists only in the page. Reloading or generating again replaces it, and there is no history to recover it from, so save it in your password manager before you leave.

The tool doesn't force one character of each type into the result. Each position is drawn from the whole pool, so a password can come out with no digit at all. With all four boxes ticked at 16 characters, about 15 in 100 passwords lack at least one of the four types, almost always a digit. At 8 characters it's about half.

If a site rejects the result, glance for a digit and a symbol and press Generate again. Don't fix it by tacking 1 on the end. It makes the last character predictable, which throws away part of the randomness.

The symbol set includes $ & ; < > and brackets, which have special meanings in shells, .env files and some config formats. It never uses quotes, backslashes, backticks, spaces or the pipe character, which avoids the worst cases.

If the password goes into a command line or a config file, either wrap it in single quotes there, or untick Symbols and add two characters to make up for it: 18 characters without symbols give 107.2 bits, a little more than 16 with them.