Passwortgenerator.

What the Password Generator does

This tool builds strong, random passwords entirely inside your browser. You choose a length (anywhere from 4 to 256 characters), how many passwords to produce in one go (up to 50), and which character families to draw from: lowercase letters, uppercase letters, digits and symbols. There is also an "exclude ambiguous" switch that removes the characters people most often mistype or confuse — capital I, lowercase l, the digit 1, capital O, the digit 0 and lowercase o. It is the tool you reach for whenever you need a fresh, unguessable secret: creating an account, rotating a password after a breach notice, generating a database or service credential, or seeding your password manager with a value no human would ever invent.

How it builds a genuinely random password

The important detail is the source of randomness. This generator uses the browser's cryptographic random number generator, crypto.getRandomValues(), not the ordinary Math.random() that powers most quick scripts. Math.random() is fast but predictable and must never be used for secrets; the crypto source is designed to be unpredictable even to an attacker who sees earlier output. On top of that, the tool avoids a subtle statistical flaw called modulo bias. If you naively take a raw 16-bit number and reduce it with value % poolSize, the lower characters in the pool become very slightly more likely whenever the pool size does not divide evenly into 65536. To prevent that, the generator uses rejection sampling: it discards the small unusable tail of the range and only keeps values that map perfectly evenly onto the character pool, so every character is exactly as likely as every other. It also guarantees at least one character from each set you enabled, then performs a cryptographic Fisher-Yates shuffle so those guaranteed characters are not predictably parked at the front.

Strength comes from entropy, measured in bits, and entropy is simply the length multiplied by the base-2 logarithm of the pool size. The combined pool here is 26 lowercase + 26 uppercase + 10 digits + 25 symbols = 87 possible characters, which is about 6.4 bits per character.

• Digits only (pool 10) — about 3.3 bits per character; fine for a throwaway code, weak for an account.
• Lowercase + digits (pool 36) — about 5.2 bits per character.
• All four sets (pool 87) — about 6.4 bits per character, so a 16-character password carries roughly 103 bits of entropy and a 20-character one crosses 128 bits.

Practical tips and gotchas

Length beats cleverness: a long password from a smaller alphabet almost always beats a short one crammed with symbols, and it is far easier to store. Turn on "exclude ambiguous" only when a human will read the password aloud or type it by hand — it slightly shrinks the pool, so add a couple of characters to compensate. Some sites silently reject certain symbols or cap the length; if a password is refused, drop the symbol set or shorten it rather than assuming the tool failed. Never reuse a password across sites — generate a unique one each time and keep it in a password manager, because the whole point of a 100-bit secret is defeated the moment it is shared between accounts. A strong password protects the login; if you also want the connection itself kept private, that is what the s4m VPN is for.

Your passwords never leave this page

Every password is generated on your own device by local JavaScript. Nothing you configure and nothing that is produced is sent to s4m, uploaded anywhere, or written to any log — there is no network request involved at all. This matters more here than for almost any other tool: a password generator that transmitted its output would be worthless, because the secret would already be exposed before you used it. You can prove the claim to yourself by opening your browser's network tab while you click Generate, or by disconnecting from the internet entirely — the generator keeps working, because it only ever needed your browser's own random source.