Password Generator & Strength Checker

How Password Generator & Strength Checker Works

This page is really two tools in one: a password generator that builds a new random password from the character types you pick, and a password checker that estimates how strong an existing password is. Both run entirely in your browser -- nothing you type or generate is sent anywhere.

Formula & Method

The generator builds a character pool from whichever types you enable (uppercase, lowercase, numbers, symbols), optionally removing ambiguous characters like l, I, 1, O, and 0. It uses your browser's cryptographically secure random number generator (crypto.getRandomValues) both to pick characters and to Fisher-Yates shuffle the final result, guaranteeing at least one character from each selected type when the length allows. Strength is reported as entropy in bits: length × log2(pool size), bucketed into Weak (under 36 bits), Fair (36–59), Strong (60–89), and Very Strong (90+). The checker estimates entropy the same way but from a fixed pool per detected character class (26 for lowercase, 26 for uppercase, 10 for digits, 32 for symbols, 64 for other Unicode characters), then downgrades the result to "Weak" regardless of entropy if the password is under 8 characters, matches a list of extremely common leaked passwords, has 3+ repeats of a single character with barely any other variety, or contains a 4-character run like "abcd" or "4321". Estimated crack time assumes an attacker can try 10 billion guesses per second against half of the possible keyspace.

Worked Example

Generating a 16-character password with all four character types enabled (no ambiguous-character exclusion) draws from a pool of 88 characters (26 uppercase + 26 lowercase + 10 digits + 26 symbols), giving about 103.4 bits of entropy -- comfortably "Very Strong". Checking an existing password like Summer2024! (11 characters, one of each class present) estimates a 94-character pool and about 72.1 bits of entropy, landing in the "Strong" tier -- and since it isn't a common leaked password, isn't too short, and has no repeated or sequential runs, it keeps that rating. At an assumed 10 billion guesses per second, that works out to roughly 8 thousand years to crack.

Frequently Asked Questions

Is the generated password actually random, or just pseudo-random?

It uses your browser's Web Crypto API (crypto.getRandomValues), which is a cryptographically secure random number generator -- the same class of randomness used for encryption keys, not the weaker Math.random().

Why do the generator and the checker report different pool sizes for a similar password?

The generator knows the exact symbol set it drew from (26 specific symbol characters), while the checker only sees the finished password and has to guess -- it assumes a fixed pool of 32 possible symbols whenever it detects any symbol character, since it can't know which exact symbol set you were choosing from.

Does the strength checker send my password anywhere to check it against leaked password lists?

No. The "common password" check is just a short, fixed list of extremely common passwords built into the page's own JavaScript -- everything happens locally in your browser, and your password is never transmitted or stored.

Why does a long password sometimes still get marked "Weak"?

Entropy alone can be misleading -- a long password made of a repeated or sequential pattern (like "aaaaaaaaaaaa" or "abcdabcdabcd") is far easier to guess than its raw bit count suggests, so the checker forces a "Weak" rating whenever it detects those patterns, regardless of length.