Password strength is a property of how the password was chosen, not how it looks. A twenty-character string drawn from a 70-character alphabet carries about 123 bits; four words from a 24-word list carries under 19. Both are shown here so the difference is visible.
What you can control
- Three modes: random characters, word passphrases, and numeric PINs for anything that only accepts digits.
- Toggle uppercase, digits and symbols independently to match a policy you are testing against.
- Look-alike filtering removes
0,O,1,landI— worth it for anything a person has to read aloud or retype. - The entropy column shows bits and a plain rating, so you can see what a policy actually buys you.
What this is not
This runs on a seeded pseudo-random generator so results stay reproducible, which is exactly what you do not want for a real credential. Use your operating system's CSPRNG or a password manager for anything that protects a real account.
Questions
Is it safe to use these as real passwords?
No. The generator is deterministic by design — the same seed always produces the same password. That property makes it useful for fixtures and useless for security.
How is the entropy calculated?
Length multiplied by the base-2 logarithm of the alphabet size. It measures the choice space this generator drew from, which is the honest way to state password strength.
Why is a four-word passphrase rated weak here?
Because the word list is short. Real passphrase schemes such as Diceware use lists of several thousand words; increase the word count to compensate, or use the random-character mode.