How the Password Generator Builds Strong Random Passwords
What this tool does
This tool assembles a random password from the character types you enable — uppercase letters, lowercase letters, numbers, and symbols — at any length between 4 and 128 characters. Each character is drawn using crypto.getRandomValues, the browser's cryptographically secure random source, rather than the predictable Math.random that many quick scripts rely on, and every type you turn on is guaranteed to appear at least once. A strength meter rates every result as Weak, Medium, or Strong from its entropy in bits, and the passwords you copy stay in a short list so you can grab one again while you decide which to keep.
When to use it
Reach for it whenever an account, database, API key, or Wi-Fi network needs a credential that no person would ever choose on their own. Generated strings carry no dictionary words, keyboard patterns, or personal details, which is exactly what defeats guessing and brute-force attacks. It is also handy when a site enforces a specific policy — say, a minimum of 16 characters with at least one symbol — because you can dial the length and character sets to match before you copy. When a client has to send that credential in an HTTP Basic auth header, the Base64 encoder produces the exact encoded string the header expects.
A concrete example
Suppose a service requires 20 characters including symbols. Set the length to 20 and leave all four character types on — a new password appears right away, something like k7$Rf2!qXm9@Lp4#Vn8w. If you plan to type it by hand or read it aloud, enable Exclude similar characters so lookalikes such as the letter l, the digit 1, capital O, and zero never appear, and Exclude ambiguous characters to drop brackets and quotes that some input fields handle poorly.
Notes and edge cases
Length matters more than any single trick: each extra character multiplies the number of possible combinations, so a longer password from a smaller set often beats a short one packed with symbols. Turning off a character type shrinks that pool, and disabling every type leaves nothing to build from, so at least one must stay selected. Finally, reuse is the real weakness — a password is only as safe as the one site it protects, so generate a fresh, unique one for each account instead of sharing a single strong string everywhere. If you need to record or compare a password without keeping the plain text around, run it through the hash generator and store the SHA-256 fingerprint instead.