A strong password is just enough randomness — and randomness is measurable. This generator runs entirely in your browser on crypto.getRandomValues, the same cryptographic source your bank's login page uses, and reports the entropy honestly.
Why "generated locally" matters
A password that has ever crossed the network is a password with a history. Here, nothing is transmitted, stored or logged — the page even works offline (try airplane mode). The randomness uses rejection sampling for perfectly uniform character selection; no modulo bias, no Math.random().
Entropy: the only strength number that matters
Sixteen characters over the full 94-symbol set is 16 × 6.55 ≈ 105 bits — a search space no earthly hardware exhausts. The meter tiers are honest: below 50 bits is weak against offline cracking, 80+ is strong, 110+ is excellent. Length beats cleverness: adding 4 characters helps more than any symbol sprinkled into a short password.
Practical toggles
The exclude 0O1lI option removes lookalike characters for passwords a human might read aloud or retype — WiFi keys, one-time shares — at a negligible entropy cost. At least one character class always stays on, and every option change regenerates immediately so a stale password never lingers on screen.
Passwords vs passphrases vs managers
The real modern answer: a password manager storing unique 20+ character random strings, with a memorable passphrase guarding the vault itself. NIST's current guidance drops calendar-forced rotation — uniqueness per site and breach response beat ritual changes. For random numbers rather than strings, the random number generator uses the same crypto source.
All generation local; this site never sees your passwords.