Generate a strong password
Real randomness, generated on your machine and never transmitted.
Pick at least one character type128 bits of entropy. Overkill, in a good way.
Generated in your browser using crypto.getRandomValues, with rejection sampling so no character is likelier than another. It is never sent anywhere, which is the only way a generated password can be trusted.
Questions
- How is this different from other password generators?
- Two ways that matter. It uses the browser cryptographic random source rather than Math.random, which is predictable and unsuitable, and it generates in the page rather than on a server. A password that travelled over the network has been seen by whoever served it.
- What does the entropy number mean?
- It is how many bits of genuine randomness the password carries, worked out from its length and the size of the character set. Above 80 bits is strong for anything ordinary. It is a more honest measure than a coloured bar, which mostly guesses at whether a human chose the word.
- Should I turn off symbols?
- Only if something refuses to accept them. Length does more for strength than variety does, so a longer password with fewer character types beats a short one with everything switched on.