What makes a password strong?
Password strength comes from length and character set diversity. Every additional character multiplies the number of guesses an attacker must make. A 16-character password drawn from 94 printable ASCII characters has 94^16 possible combinations — roughly 3.7 x 10^31. ServoDev generates passwords using crypto.getRandomValues, the browser's cryptographically secure random number generator, so results are genuinely unpredictable. The entropy display shows exactly how hard each password is to crack.
How to use this tool
- 1 Drag the Length slider or type a value — 16 characters is a solid default; 20+ for sensitive accounts.
- 2 Toggle character sets: uppercase A-Z, lowercase a-z, digits 0-9, and symbols !@#$... Each additional set multiplies the search space.
- 3 Check Exclude ambiguous to remove characters like 0, O, l, 1, I that look alike — useful when typing manually.
- 4 Click Generate for a fresh batch, or change any setting to auto-regenerate. Copy individual passwords with the icon that appears on hover.
Frequently asked questions
Is crypto.getRandomValues truly random?
Yes. crypto.getRandomValues draws from the operating system's entropy pool (the same source used for SSL keys). It is cryptographically secure and suitable for generating secrets, not just decorative randomness.
What does entropy mean in this context?
Entropy (in bits) measures how many random bits were used to produce the password. A password with N bits of entropy would require 2^N guesses on average to brute-force. 80+ bits is strong against modern attacks; 100+ bits is considered very strong even against future hardware.
Should I use a password manager?
Yes, always. A password manager lets you use a unique randomly-generated password for every account without memorizing them. Generate passwords here, then save them in your manager. Never reuse a password across sites — a breach of one site exposes all others that share it.
Why is Exclude ambiguous useful?
When you need to type a password manually — on a device where paste is disabled, or reading it aloud — ambiguous characters like 0 and O, or l and 1, cause transcription errors. Excluding them trades a small reduction in entropy for zero typing mistakes.
Is my generated password sent anywhere?
No. Every password is generated entirely in your browser using crypto.getRandomValues. No request is made to any server.