Password generator

A strong password is a long one drawn at random. Length beats cleverness by a wide margin: twenty random lowercase letters are far harder to guess than eight characters with a substituted @ and a trailing exclamation mark, because the second one follows a pattern that cracking software tries first.

The number under the meter is entropy in bits, and it is the entropy of the generator rather than of the string. That distinction matters: this tool knows the password was picked uniformly at random from a pool of a known size, so log2(pool^length) is exactly right. A checker looking at a password somebody invented can only guess, and will happily award "Summer2024!" a score it has not earned. The estimated guessing time assumes an offline attack at ten billion guesses a second, which is roughly one modern GPU against a poorly-hashed database — pessimistic on purpose.