Password Generator

Entropy (bits) = Length × log₂(Charset size)
Guesses needed to exhaust the space = 2^Entropy

• Lengthnumber of characters generated
• Charset size26 lowercase, 52 mixed case, 62 alphanumeric, 94 printable ASCII including symbols
• Entropybits, where each additional bit doubles the search space

• Length beats character variety, and the arithmetic is not close. Eight characters from all 94 printable ASCII symbols gives 8 × 6.55 = 52.4 bits. Twelve characters of nothing but lowercase letters gives 12 × 4.70 = 56.4 bits and wins. Every character added multiplies the space by the whole alphabet size, while adding a symbol class only nudges the per-character figure upward.
• The formula holds only where each character was drawn independently and uniformly from the full set using a cryptographic random source, meaning the operating system CSPRNG. A generator built on a general-purpose random function is predictable: the internal state of a fast PRNG can often be recovered from a handful of outputs, and every password it produced before and after then follows. Mapping random bytes onto a charset with a plain modulo also skews the distribution unless the charset size divides evenly into the byte range.
• Entropy describes the generator, never the string. A person choosing Tr0ub4dor&3 produces something that satisfies any character-class checker and falls quickly to a cracking rig, because those substitutions sit in every wordlist. The same 105-bit figure would be meaningless attached to a human-chosen password.
• Rules demanding at least one character of each class shrink the space slightly, by excluding every combination missing one. The size of that effect is negligible; the behaviour it produces is not, since forced complexity pushes people toward predictable shapes. NIST SP 800-63B dropped composition rules and scheduled expiry for exactly that reason, in favour of length plus a check against known breached passwords.