Password Generator

Character class controls let you exclude ambiguous characters (1, l, I, 0, O) when the password will be transcribed by hand or dictated over a phone, at the cost of some entropy, excluding 5 characters from the 94-character ASCII set drops per-character entropy from 6.55 bits to 6.47 bits, which is negligible for typical password lengths. Excluding specific symbols is sometimes necessary for systems that reject certain characters (banking sites frequently reject `< > & `); check the constraints of your target system before generating.

The entropy displayed next to each password is the correct "if generated uniformly from this character set" value. It does not account for biases introduced by minimum character class requirements, which is a subtle effect: forcing "at least one digit" on an 8-character password slightly reduces total entropy compared to unconstrained 8-character passwords from the same alphabet, because passwords without digits are excluded from the output space. The practical effect is small (less than 1 bit for typical settings) and irrelevant compared to the entropy gain from using a longer password in the first place. For anything important, length beats complexity: a 20-character lowercase-only password has more entropy (94 bits) than a 12-character password using the full printable-ASCII set (78.6 bits) and is easier to type.

The generator works alongside a password manager, not instead of one. Generate a strong unique password for each account, then let the manager remember it. The threat model for a password generator is "an attacker steals a password database and tries to crack hashes offline"entropy matters here because the attacker can try billions of guesses per second. The threat model for a password manager is "an attacker steals your machine and extracts the manager's encrypted vault"the vault's master password is the single point of failure, so that one password needs to be both memorable and high-entropy (a 4-7 word Diceware passphrase is a good pattern; it produces 52-91 bits of entropy from a 7776-word list at 12.9 bits per word). Never reuse passwords across sites, because a breach of any site that stored passwords weakly exposes every account that shares the same password.