How length and character groups set a random password's range
The generator draws characters from the groups you select using the browser's cryptographic random-number source, then shuffles their positions. It guarantees at least one character from every included group under this product rule. The secret is created only after a visitor asks for one; the public worked example does not contain a password anyone should use.
A password generator chooses symbols from an allowed alphabet. Here the alphabet is the union of the included lowercase, uppercase, digit and symbol groups. The tool deliberately inserts one independently drawn character from each selected group, fills the remaining positions from the combined alphabet and shuffles the completed sequence. Random indices come from Crypto.getRandomValues rather than Math.random. Rejection sampling discards values above the largest multiple of the target group size, preventing the usual modulo shortcut from favoring some characters.
The generator runs on the visitor's device, visibly labels the selected character sets and offers a fresh draw without publishing a sample secret. Its algorithm and clipboard limits are stated next to the result.
How length and the four character groups change the possible outputs
The page shows no strength score, but its inputs set how many passwords could be drawn. The bit figures below are plain arithmetic on the alphabet sizes the generator uses.
- Password length
- A whole number from 12 to 64; 11 or 65 is rejected. Each added character multiplies the possibilities by the alphabet size, so with all four groups, an 84-character alphabet, 16 characters give at most about 102 bits of randomness and 20 give about 128. Use the longest length the destination accepts.
- Lowercase and uppercase letters
- Twenty-six characters each. Lowercase alone gives a 26-character alphabet, and 12 such characters come to about 56 bits, far fewer than the same length drawn from all 84. Look-alike characters such as l, I, O and 0 are not removed, so read carefully if you must type the result by hand.
- Digits
- Ten characters, 0 through 9. With letters and digits but no symbols the alphabet is 62, and 16 characters give about 95 bits; raising the length to 18 gives about 107 bits, more than 16 characters with symbols. That trade is useful when a site refuses symbols.
- Symbols
- Exactly 22 are used: ! @ # $ % ^ & * ( ) - _ = + [ ] { } : , . ? Spaces, quotation marks, slashes, backslashes, pipes, semicolons, angle brackets, tildes and backticks never appear. If a site rejects one of the 22, the only switch is to exclude every symbol and add length instead.
- One character from each group
- Every included group is guaranteed at least one character, placed before the final shuffle. With four groups and a 12-character length, four positions are filled this way, which slightly reduces the number of possible passwords compared with a completely free draw. That is why the bit figures above are upper bounds.
Steps
- Choose a length from 12 to 64 that the destination account accepts.
- Include or exclude lowercase, uppercase, digits and symbols; at least one group must remain included.
- Select Generate password, then copy the result into a trusted password manager or account form. Generate another for a different random draw.
Reading tip: Check the destination site's allowed characters before including symbols. Copying a password puts it on your system clipboard, where other software may be able to read it; paste into a trusted destination and clear your clipboard when appropriate. Save the result in a password manager before leaving the page because Calculation Guide cannot recover it.
Account situations where a fresh random draw helps
Create a unique account secret
Generate a new random string for one account and save it securely.
Meet a site's character rule
Include the character groups accepted by the destination form.
Refresh an old password
Create a new draw instead of tweaking the previous secret.
Choose an acceptable length
Set a whole length within the site's limits and the tool's 12–64 range.
How the calculation works
- A
- Concatenated selected characters, with 26 lowercase, 26 uppercase, 10 digits and 22 symbols available.
- x
- One unsigned 32-bit value from browser Crypto.getRandomValues().
- L
- Visitor-chosen whole password length from 12 through 64.
- shuffle
- For every position from last to first, swap with an independently chosen earlier-or-same position.
The settings and steps are verifiable; no public worked-example secret is provided for reuse.
What every part means
- A
- Concatenated selected characters, with 26 lowercase, 26 uppercase, 10 digits and 22 symbols available.
- x
- One unsigned 32-bit value from browser Crypto.getRandomValues().
- L
- Visitor-chosen whole password length from 12 through 64.
- shuffle
- For every position from last to first, swap with an independently chosen earlier-or-same position.
Calculate it step by step
At least one group is required. Included groups have 26, 26, 10 and 22 listed characters respectively.
This maps accepted random integers evenly to an index in the chosen character set.
A Fisher–Yates shuffle removes fixed positions for the group-guarantee draws.
MDN documents Crypto.getRandomValues as producing cryptographically strong random values. Calculation Guide defines the allowed characters, 12–64 length form range, one-per-selected-group rule and rejection-sampling/shuffling algorithm. It does not claim a given password is impossible to guess or accepted by every website. The generated secret is not written into the server-rendered example HTML.
See how Calculation Guide tests examples and handles calculation limits.
See it in practice
- Password length
- 16 characters
- Lowercase letters a–z
- Include
- Uppercase letters A–Z
- Include
- Digits 0–9
- Include
- Symbols
- Include
Select L=16 and all four groups. Draw one character from each group, fill 12 more from their combined alphabet, then securely shuffle the 16 positions. The actual password is generated only after you request it.
- Length16
- Character groups selectedlowercase, uppercase, digits, symbols
Interpretation & limitations
How to read your result
For the 16-character all-groups example, the public page shows only the requested settings and a 16-character outcome label. Clicking Run this example makes a new password in your browser. At least one lowercase, uppercase, digit and listed symbol will appear, but the exact string changes on every run. A set of selected groups is an input choice, not a quantified strength score.
Where this estimate stops
The tool cannot detect phishing, malicious browser extensions, compromised devices, password reuse or a site's own password policy. The clipboard is managed by the operating system and other apps, not by Calculation Guide. No promise of absolute security is made. A password is visible on your screen until the result is cleared or the page is left.
Frequently asked questions
01Is the password sent to Calculation Guide?
No. Generation is performed by the browser's Web Crypto API and this app has no password-generation server endpoint.
02Does every included group appear?
Yes. The product first draws one character from each selected group, fills the remaining positions, then shuffles all positions.
03Why does Run this example give a different string each time?
The settings repeat, but cryptographic random draws are new for every generation. The page does not publish a reusable sample secret.
04Why might a website reject the generated password?
Some sites restrict length or particular symbols. Change the selected groups or length to meet that site's stated rules.
05Can I recover a password generated earlier?
No. Calculation Guide does not store it. Save the result in a trusted password manager before leaving or generating another.
06Is a random 16-character result a guarantee of account safety?
No. Account safety also depends on the site, device, phishing resistance, unique use and how the secret is stored.