Strong Password Generator

The page opens with a 20-character password using capitals, lowercase, digits and 25 symbols, a pool of 87 characters. The slider goes up to 64. The page doesn't display a strength meter, so here is what each length gives with this pool, and with symbols switched off (62 characters):

To keep the same strength without symbols, add about two characters: 22 letters and digits give 131.0 bits, slightly more than the 20-character default.

• Email and password-manager master accounts: they lead to every other account. The 20-character default is a sensible floor. A master password you have to type often may be better as a passphrase, which this tool doesn't make.
• Admin, root and database accounts: 24 to 32 characters. Nobody types these from memory, so the extra length costs nothing.
• Service accounts and secrets kept in a vault: 32 to 64 characters, as long as the system accepts them.
• Encrypted backup archives: long, and stored somewhere you'll still have in five years. If the password is lost, so is the archive.

Long passwords fail in quiet ways. Some forms cut input at a maximum length without saying so, and some systems can accept a symbol at sign-up and then reject it at login. Before you close the page:

1. Paste the password into the form and save.
2. Store it in your password manager.
3. Log out and back in using the stored copy.

If step 3 fails, the field probably has a length limit or a banned character. Find the documented maximum, set the slider to it, untick Symbols if needed, and press Generate again. Changing the slider alone doesn't create a new password.

For every position the tool takes a 32-bit value from crypto.getRandomValues, the browser's cryptographic generator, and maps it onto the 87-character pool with a remainder. The skew that mapping introduces is about two parts in 100 million, which changes none of the figures above. The password is created in the page and never sent anywhere.

Each position is independent, so the tool doesn't guarantee one character of each type. At 20 characters, roughly 9 passwords in 100 lack at least one type, usually a digit. If a site insists, generate again rather than editing the result by hand.