Quick answer: a password generator picks each character using a source of unpredictable random numbers, from a set of allowed characters you choose. The strength comes from two things only: how many characters are possible at each position, and how many positions there are. A longer password from a bigger character set is exponentially harder to guess.

Step 1: a secure source of randomness

Not all "random" numbers are equal. Many programming languages include simple generators, such as JavaScript's Math.random(), that are fast and fine for games but predictable enough that they are not meant for secrets. Password generators should use a cryptographically secure source instead. In a browser that is the Web Crypto API (crypto.getRandomValues), which draws on randomness from the operating system. The Toolbantu Password Generator uses it.

Step 2: choosing characters without bias

Turning a random number into a character looks easy, but there is a trap. Suppose the generator takes a random byte (0 to 255) and uses the remainder after dividing by 62 to choose from 62 letters and digits. Because 256 does not divide evenly by 62, the first 8 characters would turn up slightly more often than the others. The fix is called rejection sampling: discard any random value that falls in the uneven leftover range and draw again. Good generators do this so every character is equally likely.

Step 3: the character set

You choose which groups are allowed: lowercase (26), uppercase (26), digits (10) and symbols. Excluding look-alike characters (such as I, l, 1, O and 0) makes a password easier to read aloud or type, at a small cost in strength. Many generators also guarantee at least one character from each selected group so the password satisfies site rules. This slightly reduces the number of possible results, but the effect is negligible at normal lengths.

The math: entropy in bits

Entropy measures unpredictability. For a password where every character is chosen at random, it equals length × log2(size of character set). Each extra bit doubles the number of guesses an attacker needs.

  • 8 characters from 94 printable symbols: about 52 bits
  • 12 characters from 62 letters and digits: about 71 bits
  • 16 characters from 94 printable symbols: about 105 bits
  • 20 characters from 62 letters and digits: about 119 bits

Notice that length wins. Four extra characters add more strength than switching on symbols.

Why a generated password beats one you invent

The formula above only holds if choices are truly random. People are predictable: we capitalise the first letter, add digits at the end, swap a for @. Attackers' tools try those patterns first, so a password that "looks" complex can have far fewer effective bits than the formula suggests. A generator has no habits.

Using generated passwords well

  • Use a different password for every account, so one breach does not unlock others.
  • Store them in a password manager rather than trying to memorise them.
  • Prefer length. Where a site allows it, 16 characters or more is a sensible default.
  • Turn on two-step verification where it is offered, since it protects you even if a password leaks.

For the human side of the topic, read How to Create a Strong Password.