Strong passwords in the browser (and what entropy actually means)
How QSTools generates passwords with crypto.getRandomValues, why length beats clever substitutions, and when to exclude ambiguous characters.
A strong password is mostly length + unpredictability. Substituting @ for a helps less than adding four random characters. What matters is that the generator uses a cryptographic RNG and that you never reuse the string across sites.
What QSTools does
Our Password Generator builds strings in your browser with crypto.getRandomValues (rejection sampling to avoid modulo bias). You pick length and character classes; optional “exclude ambiguous” drops look-alikes like I / l / 1 and O / 0. Nothing is uploaded.
| Choice | Why it matters |
|---|---|
| Length 16–24+ | Multiplies search space faster than adding one symbol class |
| Mix of classes | Helps against naive filters; entropy still ≈ charset^length |
| Exclude ambiguous | Better when humans type the password (Wi‑Fi, TV, shared screens) |
| Password manager | Long-term home; a generator is for create-once moments |
Rough entropy (rule of thumb)
If the charset has size S and the password length is L, a rough estimate is L × log₂(S) bits. That assumes independent uniform picks — which is what a good browser generator aims for. It is not a guarantee against phishing or reuse.
Pair with recovery hygiene
A great password still fails you if MFA recovery is a dead phone number. See our note on almost losing a Microsoft account to MFA — and prefer passkeys + printed backup codes alongside strong passwords.