Advanced Password Generator

What the "advanced" options give you

A basic password generator picks random characters from a fixed pool. This advanced version exposes the dials that matter when you have specific requirements to satisfy: a custom symbol set, the ability to strip out characters a particular system rejects, a pronounceable mode for passwords you must type or read aloud, and bulk generation of up to 20 passwords at once. Every random character is drawn from the browser's cryptographic generator (crypto.getRandomValues), and the whole process runs locally — nothing you generate is sent anywhere.

One detail worth knowing: the tool uses rejection sampling to pick each character. Naively doing random % poolSize introduces a tiny bias toward the first few characters in the set, because the random range rarely divides evenly. This generator discards the few out-of-range values and re-rolls, so every character in your pool is exactly equally likely. That's the difference between "random-looking" and "uniformly random."

Tailoring the character set to a site's rules

Plenty of systems impose maddening, undocumented password rules. The advanced controls let you match them precisely:

• Custom symbol set. Instead of a fixed list of punctuation, you supply exactly which symbols are allowed. If a bank only accepts !@#$, paste those four characters and nothing outside them appears.
• Exclude specific characters. Type any characters to ban them outright — useful when a legacy system chokes on, say, <, >, or backslashes.
• Exclude ambiguous characters. One checkbox removes the look-alikes 0 O l 1 I. This matters when a password will be read off a screen, dictated over the phone, or typed from a printout, where 0/O and l/1 cause errors.

After applying these filters the tool also de-duplicates the pool, so adding overlapping sets never quietly weights some characters more than others.

Pronounceable mode: what it trades

Toggle Pronounceable and the generator stops drawing from the full character pool and instead alternates consonants and vowels — producing strings like taborimuke that you can actually say and remember. This is genuinely useful for temporary passwords you'll read aloud to a colleague, or a memorable Wi-Fi guest code.

Be clear-eyed about the trade-off, though. Alternating consonant/vowel from a 21-letter and 5-letter pool yields far fewer combinations per character than a random mix of 90-plus symbols. A pronounceable password needs to be noticeably longer to reach the same strength as a fully random one. Use pronounceable mode for low-stakes, short-lived, or human-relayed passwords — not for your password manager's master key.

A worked example: bulk generation

Say you're provisioning ten new user accounts and each needs a starter password with no ambiguous characters. Set Length to 16, leave uppercase, lowercase, digits, and symbols enabled, tick Exclude ambiguous characters, set Quantity to 10, and click Generate. You get ten distinct 16-character passwords, each with its own strength meter, plus a Copy All button that puts them on your clipboard one per line — ready to paste into a spreadsheet or onboarding script. No two are alike, and none contains 0 O l 1 I.

Reading the strength meter

Each generated password gets a Weak / Fair / Good / Strong rating. The score rewards length thresholds (12, 16, and 24 characters) and the presence of each character class — uppercase, lowercase, digits, and symbols. Two practical takeaways:

• Length is the biggest lever. Crossing 16 and 24 characters bumps the score on its own. Adding one more character type helps, but stretching the length helps more.
• Pronounceable passwords read as weaker here, and rightly so — they use only lowercase letters, so they miss the uppercase, digit, and symbol points. Compensate with extra length.

Tips and common mistakes

• Don't over-restrict the pool. Excluding too many characters shrinks the space attackers must search. Remove only what a system genuinely forbids.
• Keep at least one character class on. If you disable every class (and aren't in pronounceable mode), there's nothing to draw from — the tool will ask you to enable at least one.
• Generate fresh per account. Bulk mode exists so you don't reuse one password across many accounts; reuse is the single biggest real-world breach vector via credential stuffing.
• Store, don't memorise. Put random passwords in a password manager. Reserve pronounceable mode for the rare cases where a human truly has to recall or speak the password.
• Copy All is plain text. Once on your clipboard, the list is unencrypted — paste it into your manager promptly and clear your clipboard afterward rather than leaving passwords sitting there.