password entropy
A strong password is not the one with the most character types, it is the one with the most possible combinations. That count is called entropy, measured in bits, and the formula behind it explains why forcing a mandatory symbol and uppercase letter often produces weaker passwords than simply asking for more characters.
This is the typical "strong" password demanded by web forms, but 8 characters leave little margin even with the maximum alphabet.
It beats the 8-character all-types password even with an alphabet almost 3.4 times smaller, purely because of length.
Length and maximum alphabet together: the generator uses `crypto.getRandomValues` with rejection sampling to keep every character uniformly distributed.
Yes. The goal is to create random passwords locally, without depending on server uploads, which reduces exposure during generation and quick copy workflows.
There is no single official cutoff, but the practical reference used by security tools marks below 28 bits as very weak and above 80 bits as comfortable against an offline attack for the foreseeable future; the length × log2(alphabet) formula lets you compute the exact value for any combination before deciding.
Because the composition rule does not truly enlarge the alphabet used, it just forces 1 character from a category inside a length that stays short; the gain from log2(88) over log2(26) is only 1.76 bits per character, far smaller than the gain from simply adding more characters overall.
The option removes 5 characters from an alphabet of up to 88, a small loss in relative terms: log2(83) works out to about 6.37 bits per character against 6.46 bits with the full alphabet, a difference under 0.1 bit per position that is worth it to avoid typos when copying the password by hand.
Yes, because the entropy = length × log2(alphabet) formula assumes truly independent characters; a long password built from a predictable pattern, like repeating a block or using a date, has much lower real entropy than the naive count suggests, even though it passes the theoretical calculation.
The password is generated locally in your browser. Nothing is sent to any server.