CalcWhenPassword Generator
A 16-character password using lowercase, uppercase, digits and symbols draws from 94 possible characters per position — roughly 105 bits of entropy, far beyond brute-force reach.
How it works
Set the length, tick the character families, and press the button — a fresh password appears with its entropy printed beside it. Every press is a new draw; nothing is reused, transmitted or remembered. Copy it straight into your password manager and it never needs to exist anywhere else.
One honest warning, printed rather than hidden: a few older systems reject certain symbols in passwords. If a site refuses your generated password, untick Symbols and generate again — at 16 characters the remaining pool still gives about 95 bits, which is far more than enough.
The method
Characters are drawn with the Web Crypto API (crypto.getRandomValues) using rejection sampling, so every character in the pool is equally likely — no modulo bias. Entropy = length × log2(pool size): the honest measure of how many guesses an attacker faces on average (half of 2^entropy).
Frequently asked questions
How long should a password be?
Sixteen characters at full settings (~105 bits) is beyond any realistic brute force. Length beats cleverness: each extra character multiplies the search space by the pool size.
Are generated passwords stored or sent anywhere?
No. Generation happens entirely on your device, in this page. The site has no account system and receives nothing — close the tab and the password exists only where you pasted it.
What if a site rejects symbols in passwords?
Untick the Symbols box and regenerate. Length is what carries the security: 16 characters from letters and digits alone still give roughly 95 bits of entropy.