Is the password sent anywhere or logged?

No. Passwords are generated locally with crypto.getRandomValues, the browser's cryptographically secure random number generator, and displayed on your screen only. Nothing is transmitted or stored — close the tab and it is gone.

How is the strength rating calculated?

The tool estimates entropy as length × log2(pool size), where the pool is the union of the character sets you enabled. Under about 40 bits rates weak, 60 fair, 80 good, 112 strong, and anything above 112 bits rates excellent.

Why can't I turn off all four character sets?

At least one set must stay enabled, otherwise the character pool would be empty and no password could be generated. The tool blocks disabling the last active set.

Password Generator

Overview

This generator draws each character from a pool built from the sets you enable — uppercase, lowercase, digits, and symbols — using crypto.getRandomValues (a CSPRNG, not Math.random). It shows a live entropy estimate in bits and a five-segment strength meter, and regenerates automatically whenever you change the length or character sets.

How to use

Set LENGTH with the slider (8–64 characters, default 20).
Toggle the CHARACTER SETS buttons: A–Z, a–z, 0–9, !@#$% (symbols). A new password appears immediately after each change.
Click generate ↻ for another password, then copy ⧉ to copy it. Check the STRENGTH meter and ENTROPY readout.

Examples

20 characters with all four sets: pool = 87 characters, entropy ≈ 129 bits → excellent.
8 characters with only a–z: entropy ≈ 38 bits → weak — increase the length or add sets.

Notes

Digits and symbols are color-coded in the display so you can read the password accurately. Aim for 80+ bits of entropy for accounts that matter, use a unique password per site, and keep them in a password manager. The symbol set is !@#$%^&*()-_=+[]{};:,.<>? — if a site rejects some of these, disable symbols and compensate with extra length.