Test data for Brazilian software
EN
Fictitious data for software testing. Using fake documents for fraud is a crime in Brazil (Penal Code, arts. 297–299, 307).

Strong password generator

Create random passwords with the browser’s cryptographic generator and check a password’s estimated strength on the Validate tab — everything runs locally and nothing leaves your device.

—

Up to 1000 items at once. Everything is generated in your browser.

How to use

  1. Set the length (4 to 128; 16 or more recommended) and tick the sets: lowercase, uppercase, digits and symbols.
  2. If the password will be typed or read aloud, enable exclude ambiguous characters (O, 0, o, I, l, 1).
  3. Click Generate, then Copy; for many test passwords, set the Quantity and use Export CSV or Export JSON.
  4. On the Validate tab, paste one or more passwords (one per line) and click Validate.
  5. Each line shows the estimated entropy in bits, a 0–4 score and any issues found; “valid” means a score of 3 or 4.

How it works

How the password is generated

  1. The sets are lowercase (26), uppercase (26), digits (10) and the symbols !@#$%&*()-_=+[]{};:,.?/ (23). “Exclude ambiguous” removes O 0 o I l 1.
  2. One character is drawn from each selected set, so every set is guaranteed to appear.
  3. The remaining positions are drawn from the union of the sets.
  4. A Fisher–Yates shuffle then mixes everything, so the guaranteed characters are not stuck at the start.

Every draw uses crypto.getRandomValues with rejection sampling: values that would introduce modulo bias are discarded and redrawn, so each character is exactly equally likely. With all four sets (85 characters) a 16-character password carries about 16 × log2(85) ≈ 102 bits of entropy (slightly less, because one character from each set is forced).

How strength is estimated (Validate tab)

The checker cannot know how a password was created, so it uses a simple, transparent estimate:

  • Pool size: +26 for any lowercase, +26 uppercase, +10 digit, +33 any other character (ASCII symbols and space).
  • Penalties on the effective length: −2 if a character repeats 3 times in a row; −3 for a run such as 1234, abcd or qwer; if it starts with password, senha, admin, qwerty or 123456, the effective length is capped at 2.
  • Bits = effective length × log2(pool). Score: 0 (< 28), 1 (28–49), 2 (50–71), 3 (72–99), 4 (≥ 100).

Worked example

aaa1234Bcd! has 11 characters and uses all four groups: pool 26 + 26 + 10 + 33 = 95. Penalties: “aaa” (−2) and “1234” (−3), so the effective length is 11 − 5 = 6. Bits = 6 × log2(95) ≈ 6 × 6.57 ≈ 39 → score 1, flagged short, repeat and sequence. Password123 gets 12 bits and score 0 because it starts with a common word.

Honest limits

Pool-based entropy is only accurate for truly random passwords like the ones this generator makes. For human-chosen passwords it overestimates: a phrase of dictionary words scores high on length, yet its real strength depends on how many words were randomly picked and from which list. In practice: use a password manager with a unique password per service, a long random passphrase for the vault, and two-factor authentication.

FAQ

Is the generated or checked password sent to a server?

No. Generation and checking run entirely in JavaScript in your browser using crypto.getRandomValues. No password is transmitted, logged or stored. You can even go offline after the page loads and the tool keeps working.

What length should I use?

For accounts kept in a password manager, 16 to 20 characters with all four sets already exceed 100 estimated bits. If a system restricts which symbols it accepts, untick symbols and add length instead: each extra character is worth roughly 6 bits.

Why did my passphrase get a score of 4?

Because the checker only measures length and character types. Long phrases score high, but real strength depends on how the words were chosen: four words drawn at random from a 2048-word list give about 44 bits. For passphrases, use five or more randomly drawn words, not words you picked yourself.

Can I generate passwords in bulk for testing?

Yes. Set the Quantity and export CSV or JSON to test password-policy rules, field length limits, escaping of symbols in forms and APIs, or to create test users in staging environments.

What does “valid” mean on the Validate tab?

It means the estimate reached score 3 or 4, i.e. at least 72 bits. Below that the line is marked weak, with the list of issues: missing lowercase, uppercase, digits or symbols, fewer than 12 characters, repeats, sequences or a common word at the start.

Sources

Related tools

Updated 2026-11-13 · Rafael Lima