Set a length and character types, then generate a password using cryptographically secure randomness.
How to Use the Password Generator
Set the length with the slider (4 to 64 characters), check whichever character types should be included — uppercase, lowercase, numbers, symbols — and click Generate. Uncheck all four and the button refuses to run rather than silently producing something weaker than you asked for.
Using crypto.getRandomValues() instead of Math.random() isn't a style preference — it's the actual security-relevant choice. Math.random() is a fast, statistically fine pseudorandom generator built for things like games and animations, not for resisting prediction. Some JavaScript engines have seeded it from the system clock or other easily-guessable state, and security researchers have reverse-engineered its internal sequence in more than one real implementation. None of that matters for shuffling a deck of cards on screen. All of it matters for a password.
What crypto.getRandomValues() Actually Does
The Web Crypto API's getRandomValues() pulls from the operating system's cryptographically secure random source — the same class of randomness used to generate encryption keys. That's the correct source for anything where an attacker guessing the next value would matter, password generation included. This calculator draws a 32-bit random integer for every character position and picks from the selected character pool with it.
possible passwords = (pool size) ^ (length)One small technical note: converting a random 32-bit integer into a range via modulo has a very slight bias when the pool size doesn't divide 2³² evenly — a real effect, but small enough to be irrelevant at these pool sizes, and not worth the added complexity of full rejection sampling here.
Length matters more than complexity. A 16-character password using only letters has more possible combinations, and takes longer to brute-force, than an 8-character password stuffed with symbols — pool size grows the possibility space linearly, length grows it exponentially. That's not an argument against symbols, though; more character types on top of more length is strictly better on every axis when the site allows it.