Password Generator

This page builds one string at a time in Password, Passphrase, or PIN mode. The default is mode "password", length 20, includeLowercase/Uppercase/Numbers/Symbols true, excludeSimilar and avoidAmbiguousSymbols false. Passphrase defaults are wordCount 4, hyphen separator, capitalize/addNumber/addSymbol off. PIN defaults to 6 digits. Output starts empty, then useEffect regenerate fills it.

There is no file input. The result is a generated string in the current tab. It does not confirm an account’s rules, protect an account by itself, replace a password manager, prevent phishing, check breach exposure, or guarantee security.

Password length

Range input min 8, max 64, step 1. Default 20. These are this slider’s bounds, not an external “safe length” standard.

Letter/digit/symbol pools

LOWERCASE a–z, UPPERCASE A–Z, NUMBERS 0–9, SYMBOLS !@#$%^&*()_+-=[]{}|;:,.<>?/~ — each optional via toggles.

Passphrase

Word count 3–10 (default 4). Separators: hyphen, space, dot, underscore. Optional capitalize, add number, add symbol.

PIN

Length 4–12 (default 6). Digits from NUMBERS only.

Avoid ambiguous punctuation is disabled when Symbols is off. Turning off every Password character type throws “Enable at least one character type.” and clears the output.

randomInt(max) requires crypto.getRandomValues. It samples a Uint32Array(1), rejects values at or above rejectionLimit (UINT32_RANGE minus UINT32_RANGE % max) so the later modulo is unbiased, then returns randomValue % max. max must be a safe integer in 1…2^32. This is not a third-party CSPRNG package and not Math.random.

getRandomChar picks one index in a string that way. generatePassword concatenates guaranteed characters plus remaining draws, then shuffleArray (Fisher–Yates swapping with randomInt(i + 1)). generatePassphrase draws PASSPHRASE_WORDS[randomInt(PASSPHRASE_WORDS.length)] independently for each slot — a word can repeat. generatePin concatenates NUMBERS[randomInt(NUMBERS.length)] pinLength times.

When at least one Password set is enabled, generatePassword maps each selected pool to getRandomChar(pool) first, then fills length minus that count from allChars (the pools joined). If length is larger than the number of pools (always true at min 8 with at most four pools), every enabled type appears at least once before the shuffle. Positions are not fixed; shuffleArray mixes them.

excludeSimilar runs replace(/[ilLI|oO0]/g, "") on each active pool, including symbols (so | is removed from SYMBOLS). avoidAmbiguousSymbols replaces SYMBOLS with SAFE_SYMBOLS (!@#$%^&*_+-=) before that filter. Both can apply together. Passphrase “Add symbol” always uses SAFE_SYMBOLS, not the full SYMBOLS string. Passphrase “Add number” appends separator plus randomInt(10) (one digit 0–9).

estimatePasswordEntropy is Math.round(length * Math.log2(allChars.length)) from the current filtered pool — a uniform independent-character sketch. It does not model the guaranteed-one-per-set step. estimatePassphraseEntropy is wordCount * log2(PASSPHRASE_WORDS.length), plus log2(10) if addNumber, plus log2(SAFE_SYMBOLS.length) if addSymbol. Capitalize and separator are not in that formula (separator is user-chosen; capitalize is deterministic). estimatePinEntropy is Math.round(length * Math.log2(10)). Empty pool → 0 bits.

calculateStrength bins those bits: Weak if < 28, Fair if < 36, Strong if < 60, otherwise Very strong, with bar widths 25%/50%/75%/100%. Those cutoffs are this component’s, not a cited NIST or site-policy table. The estimate is not zxcvbn, not a dictionary attack simulation, and not a check that the string is absent from breach corpora.

1. Read Generated output. On mount, Password is pressed and regenerate fills the box. There is no Generate button or file picker. Empty or error output is an em dash.
2. Click Copy password (Copied for 1.5 seconds; disabled while empty). The label does not change in Passphrase or PIN. Failure shows “Copy failed. Please copy manually.”
3. Click Regenerate for another draw with the same settings, or Hide then Show to mask with "•".repeat(Math.min(password.length, 64)). Hide/Show stay disabled while empty.
4. Click Password, Passphrase, or PIN (aria-label Generator mode). handleModeChange clears copied/error; the effect regenerates.
5. In Password, move Length (min 8, max 64, default 20, “N characters”). Toggle Uppercase, Lowercase, Numbers, Symbols (all on at mount), Exclude similar, and Avoid ambiguous punctuation (disabled when Symbols is off). Turning every character type off throws “Enable at least one character type.”
6. In Passphrase, move Word count (3–10, default 4, “N words”). Click Separator Hyphen, Space, Dot, or Underscore, then optionally Capitalize words, Add number, or Add symbol.
7. In PIN, move PIN length (4–12, default 6, “N digits”). The helper text is Numeric PIN only.
8. Read Strength: Rating Weak / Fair / Strong / Very strong, Mode, Length, Character sets, and Entropy estimate. Missing Web Crypto shows “Secure random generation is unavailable in this browser.” There is no download, Clear, Load example, history, or leak check.

This component only constructs a string and optionally copies it. It does not save the value to localStorage, IndexedDB, a vault, or an account. It does not encrypt a password store, sync devices, offer favorites or history, or recover a previous output after Regenerate or a refresh. It does not query HIBP or any leak API. Put the value in a password manager you already trust if you need storage — this page is not that manager.

• That a destination site will accept the character set, length, or passphrase format.
• That the value is unguessable, unbreakable, or “universally strong.”
• That you stored it safely, typed it into the real site, or avoided phishing.
• That it has never appeared in a breach list.
• Collision-free uniqueness against other users’ passwords or this list’s repeated passphrase words.

The amber sidebar note says generation is local and not to reuse passwords across accounts. That is on-page guidance, not a technical enforcement. The generator cannot see other accounts.

generatePassword / generatePassphrase / generatePin run in the page with Web Crypto. The string is not POSTed to a password API. PasswordGenerator.jsx does not import trackToolEvent. Copy writes to the clipboard when permitted. Hide only changes rendering. Site assets, ads, extensions, shared screens, and anything you paste into another app remain outside this file. A refresh discards React state; there is no server-side recovery.

• Confirm the mode (password vs passphrase vs PIN) matches what the account actually allows.
• If a site forbids symbols or similar characters, use the toggles here — then still check that site’s own rule, because this page does not fetch policies.
• Copy before changing sliders; settings regenerate and drop the previous string.
• Treat Weak/Fair/Strong/Very strong as this UI’s bit bins, not a pass/fail from the destination.
• Store the value in your own manager if you need it later; this tab will not recall it.
• Do not reuse the same generated string across accounts (the sidebar says so; the code does not check).

• Hash Generator — when you need a lowercase hex digest of text or a file. This page does not hash, salt, or store the generated string.
• UUID Generator — when you need a UUID v4 or v7 identifier. This page does not emit UUID-formatted values.