Password Generator

Each password is assembled in three steps:

1. One character is drawn at random from each enabled set (uppercase, lowercase, digits, symbols) so no selected set is accidentally missing.
2. The remaining positions are filled with random draws from the combined pool of all enabled sets.
3. The characters are shuffled with a Fisher–Yates shuffle driven by crypto.getRandomValues(), so the guaranteed characters don't sit in predictable positions.

Length matters more than complexity: every extra character multiplies the search space by the pool size, which is why the slider goes up to 64.

With length 16 and all four sets enabled, you'll get something like k7#Qm2@xZ9!vB4$nL (yours will differ). It contains uppercase, lowercase, digits and symbols — and at 16 characters from a ~90-character pool, it has about 104 bits of entropy, far beyond what brute force can touch.

The strength badge is a simple honest heuristic: Weak if the password is under 10 characters or uses a single character class, Strong otherwise. It's a rough guide, not a security audit — a 12-character password is fine for most accounts, but use 16+ for anything critical and a unique password per site.

Copy puts the password on your clipboard — paste it into a password manager rather than memorising it.