What the generator does
It creates random passwords of 4 to 128 characters from the sets you choose — upper- and lowercase letters, digits and symbols — and passphrases of 3 to 10 words. You can require at least one character of each type, exclude look-alikes, or forbid repeats.
Why randomness matters
Human-made passwords follow predictable patterns: words, dates, letters swapped for digits. Attackers try those patterns first. Here every character is picked by the browser's cryptographically secure generator (crypto.getRandomValues) without distribution bias, so strength depends only on length and character set.
Password or passphrase
A random string of characters packs the most entropy per character and suits a password manager. A passphrase is a few random dictionary words: longer, but easier to remember and type. Its strength comes from the dictionary size, not the letter count: 6 words from a 7,600-word list give about 77 bits.
Why generation is local
A password that has passed through someone else's server can no longer be treated as secret. That is why Runstack generates passwords in your browser: the page makes no network requests with the password, and analytics only records that the tool was used.
FAQ
Does Runstack store generated passwords?
No. A password only exists on the open page: it is not sent to a server, written to the URL, cookies or localStorage, or included in analytics. Once the tab is closed it is gone.
How long should a password be?
For accounts kept in a password manager, 16–24 random characters is plenty. For a master password you need to remember, a 5–6 word passphrase is easier.
Why exclude look-alike characters?
If a password will be read from a screen or paper and typed by hand (Wi-Fi, for example), characters like 0 and O or 1 and l are easy to mix up. Entropy drops slightly; the indicator accounts for it.
What does the bit estimate mean?
It is the theoretical entropy of passwords randomly produced by this generator. Every bit doubles the number of guesses an attacker would need. It does not apply to passwords chosen by people.