⚗

FREETOOLS LABS

FreeTools Labs Glossary

Secure passwords

Learn how length, character pool and random selection affect a password’s theoretical strength, and how the generator creates characters locally.

Relevant tool

Password generator

Generate strong random passwords entirely locally.

Open Password generator →

Password strength in this generator depends on character-pool size and length, while cryptographic randomness determines how a candidate is selected from that space.

Functions and inputs

The public settings are an integer length from 8 to 128, uppercase, lowercase, digits, symbols and an option that excludes ambiguous characters. There is no custom charset, word list, passphrase, batch generator, copy feature or password-manager function.

Calculation model

The displayed theoretical strength uses the active pool and the chosen length to express the combinatorial space in bits: bits = length × log₂(pool size); 20 × log₂(85) = 128.19 bits.

How the calculator model works

Each active character group contributes at least one character, remaining positions come from the combined pool, and all positions are shuffled. `crypto.getRandomValues()` is required; rejection sampling prevents direct modulo bias and no `Math.random()` fallback exists. Changing a setting clears the previous result.

Checked examples

These checked settings contrast the default mixed-character pool with an excluded-character pool and a digits-only case: L=8–128; default L=20; crypto.getRandomValues(); rejection sampling; Fisher–Yates. L=20, groups=4, pool=85 → 128.19 bits; exclusion: pool=79 → 126.08 bits. L=12, digits, pool=10 → 39.86 bits.

Units, display and interpretation

The bit value is a mathematical orientation for the generated character space, not a claim about every account, service or attack scenario: 8–128 characters · active pool size · theoretical bits; classes <50, <80, <120, ≥120.

Scope and limits

The displayed strength is a theoretical orientation based on length and pool size, not a promise about attack time or account security. The module keeps a generated value in local page runtime only and does not assess the target service or password reuse.