Strong Password Generator

Generates random passwords locally in the browser using crypto.getRandomValues, with a live strength meter and an estimated crack time — nothing is transmitted, so the password never exists outside your own device until you use it.

Length beats complexity

Adding characters to a password multiplies the number of possible combinations an attacker has to try; swapping a letter for a symbol only adds a little. A random 8-character password with mixed characters can be brute-forced in hours on modern hardware; a random 16-character one pushes that estimate into a range that's effectively uncrackable by brute force for the foreseeable future. If forced to choose between longer-but-simpler and shorter-but-complex, longer wins by a wide margin.

Character sets and ambiguous characters

Turning off ambiguous characters removes look-alikes like 1/l/I and 0/O from the pool — worth doing for any password that has to be typed by hand from a printed card rather than pasted from a password manager, where a misread character is the difference between logging in and getting locked out.

Passphrase mode

Instead of a random character string, passphrase mode strings together several random dictionary words — something like 'correct-horse-battery-staple' rather than 'xK9$mQ2#vL'. A passphrase of four or five random words can carry as much entropy as a shorter random-character password while being genuinely easier for a person to remember and type without a manager, at the cost of being longer to type out in full.