# Password Generator

> Generate strong random passwords with the system random source, entirely in your browser.

Canonical: https://host-tools.com/tools/password-generator/

---

## What does this tool do?

Generates random passwords of the length you choose, with the character sets you choose, and tells
you how much entropy the result actually has.

## Two details that matter more than they look

**The random source.** The passwords come from `crypto.getRandomValues`, the browser’s
cryptographic generator. `Math.random` is faster and is not random enough for this: its output can
be predicted from previous values.

**The sampling.** Each character is drawn with rejection sampling rather than a modulo. Taking
`value % alphabetLength` makes the first characters of the alphabet slightly more likely than the
last, because the range of a 32-bit number is not a multiple of 94. The bias is small and it is
real, so it is not there.

At least one character from each set you enable is guaranteed, then the result is shuffled: a free
draw over twelve characters can easily leave out the symbols, and plenty of sites insist on them.

## Reading the number

Entropy in bits is `length × log₂(alphabet size)`. Roughly: **under 50 bits** is weak, **80 bits** is
fine for most accounts, **128 bits** is beyond any brute force. A 16-character password with symbols
lands around 100 bits. If you need something you can type from memory, a longer password of plain
words beats a short pile of symbols.

## Keep in mind

Nothing is stored, logged or sent anywhere: the passwords are generated in your browser and exist
only on screen, so copy what you need before closing the tab. And if you are generating a password
for a service you care about, a password manager is still a better answer than a good memory.