Password Generator – Complete Guide to Strong Random Passwords and Entropy

Humans are bad at randomness. Passwords people invent follow patterns — a word, a capital letter at the start, a year and an exclamation mark at the end — and attackers' cracking rules are built around exactly those patterns. A generated password from a proper random source has none of them, and its strength can be calculated instead of guessed.

The Password Generator creates random passwords in your browser with the length and character types you choose, guarantees that every selected type appears, can exclude look-alike or problem characters, and shows the strength of the settings in bits.

What is a password generator?

In simple terms

A password generator picks characters at random from a set you choose — for example lowercase, uppercase, digits and symbols — until the password has the length you want. Because each character is chosen independently and unpredictably, nobody can guess the result better than by trying combinations, and the number of combinations is enormous for long passwords.

Technical background

Security depends on two things: the quality of the random source and the size of the search space.

Random source. Ordinary pseudo-random functions such as Math.random() are not suitable for secrets. Browsers provide a cryptographically secure generator through the Web Crypto API, crypto.getRandomValues() (MDN). Turning random 32-bit numbers into an index into a character set needs care: taking value % n makes some characters slightly more likely when 2^32 is not a multiple of n (modulo bias). Rejection sampling discards values above the largest multiple of n and draws again, so every character is equally likely.

Search space and entropy. For a password of length L drawn uniformly from N possible characters, there are N^L possibilities, or L × log2(N) bits of entropy. With all 94 characters of the NetTools pool, each character adds about 6.55 bits; 16 characters give about 105 bits. If characters may not repeat, the count is the number of permutations, N!/(N − L)!, which is slightly lower.

Guidance such as NIST SP 800-63B emphasizes length and screening against known compromised passwords over composition rules. A generated password satisfies both: it is long and random, and so does not appear in breach lists by accident.

Why use the Password Generator?

• Create credentials that resist guessing and cracking, for user accounts, service accounts, database users and API dashboards.
• Meet awkward policy rules (a required symbol, no repeated characters, a forbidden character) without falling back to predictable patterns.
• Avoid transcription errors when a password must be typed on a console, TV or printer panel, by excluding look-alikes.
• Generate several at once, for example when provisioning a batch of test or lab accounts.

Who should use it?

• System administrators creating local admin, service and database passwords.
• Network engineers setting device, SNMPv3, RADIUS or Wi-Fi credentials.
• Developers needing test credentials and seed values.
• Anyone who wants a strong password without trusting a server to generate it.

How the Password Generator works

Everything happens in your browser; no request is made when you generate, and nothing is stored.

1. The page builds the character pool from the selected types: lowercase (26), uppercase (26), digits (10), special characters (24: ! @ # $ % ^ & * - _ = + ~ | \ : ; " ' , . ? / backtick) and brackets (8: ( ) [ ] { } < >). With all five selected, the pool has 94 characters.
2. Exclusions are removed: the look-alike option removes i I l L 1 | o O 0, the backtick, single quote and double quote (12 characters, leaving 82 with all types on); anything typed into the exclude field is removed too.
3. The settings are validated: length 4–128, count 1–50, at least one type, no type emptied by exclusions, the length at least the number of selected types, and enough distinct characters when "each character only once" is on.
4. Each character is picked with crypto.getRandomValues() and rejection sampling. If a candidate lacks one of the selected types, it is discarded and a new one is generated, which keeps the result uniform over all valid passwords.
5. Strength is estimated as L × log2(N), or the permutation formula when characters cannot repeat, and labelled Very weak (< 40 bits), Weak (< 60), Fair (< 80), Strong (< 100) or Very strong (≥ 100). The requirement that each type appears lowers the true count only slightly, so the number is an estimate.

The password is displayed with characters colored by type, which helps when reading it aloud.

How to use the NetTools.tech Password Generator

1. Open the Password Generator. A 16-character password with all types is generated immediately.
2. Set Password length with the slider or the number field (4–128).
3. Set Number of passwords (1–50). With more than one, an All passwords list appears with a copy button for each and Copy all.
4. Under Character types, select Lowercase, Uppercase, Digits, Special and/or Brackets.
5. Open Advanced options for Each character only once, Exclude look-alike characters, and Exclude the following characters.
6. Every change regenerates immediately; press Regenerate for a new password with the same settings.
7. Press Copy and paste the password straight into your password manager or the target system.

Understanding the results

Example: choosing settings for different targets

The strength figures below are what the generator shows for these settings:

16 chars, all types (94 possible)            ≈ 105 bits · Very strong
16 chars, look-alikes excluded (82 possible) ≈ 102 bits · Very strong
12 chars, all types                          ≈ 79 bits  · Fair
20 chars, all types                          ≈ 131 bits · Very strong
16 chars, digits only (10 possible)          ≈ 53 bits  · Weak

A Wi-Fi key that guests type from a printed card works well as 20 characters with look-alikes excluded. A legacy device that rejects quotes and backslashes needs only "'\ in the exclude field, not all symbols switched off. A PIN-style "digits only" password needs to be much longer to reach the same strength.

Common use cases

• Setting a new local administrator password on servers and network devices.
• Creating database and service account credentials for configuration files or secret stores.
• Generating Wi-Fi pre-shared keys.
• Producing a batch of unique passwords for lab or training accounts.
• Replacing a password that the Password Checker found in breach data.

Troubleshooting

"Length … is too short to include all … selected character types"

Each selected type must appear at least once. Increase the length or deselect types.

"Your exclusions remove every character from: …"

The exclude field or look-alike option removed all characters of a selected type. Remove some exclusions or deselect that type.

"Only … different characters are available"

With "each character only once", the length cannot exceed the pool size. Turn the option off or add character types.

The target system rejects the password

Many systems limit length or forbid specific characters. Find the rule, exclude the problem characters, and keep the length as high as allowed.

Copy does nothing

Clipboard access can be blocked by browser settings or when the page is not focused. Select the password manually.

Common mistakes

• Generating a strong password and then modifying it by hand to make it memorable.
• Reusing one generated password across several accounts.
• Turning off all special characters when only one or two are rejected.
• Leaving passwords in the clipboard, chat history or tickets after use.
• Using short lengths for secrets that can be attacked offline.

Limitations

• The bits figure is the entropy of the settings, assuming the password is used exactly as generated. It is not a cracking-time estimate; for that, use the Password Checker.
• It does not generate word-based passphrases, PINs with special constraints, or pronounceable passwords.
• It cannot know a target system's character rules; you have to set exclusions yourself.
• Security also depends on your device: malware or a compromised browser extension can read anything on the page or clipboard.

Security & privacy

Passwords are generated locally with a cryptographically secure random number generator and are never sent to NetTools or stored. Copying places the password on your system clipboard, where other applications or clipboard history tools may see it; paste it into your password manager and clear the clipboard if your system keeps a history. The generator never asks for an existing password.

Related tools

• Password Checker – test strength against attacker patterns and check breach data. Guide: Password Strength Checker guide.
• Web Pentest & Security Assessment – check your website's exposure. Guide: Website security assessment guide.
• SSL Checker – verify certificates protecting login pages. Guide: SSL Certificate Checker guide.
• Overview: Security & Testing tools.

Summary

The Password Generator creates random passwords in your browser from the character types you choose, using crypto.getRandomValues() with rejection sampling, guaranteed character-type coverage and optional exclusions. Its strength figure is length × log2(pool size): 16 characters from all 94 characters is about 105 bits. Generate, copy into a password manager, and never edit the result by hand.