What makes a password strong
Strength comes from two things: length and randomness. A password picked by a person follows patterns, such as a word, a capital at the start and a number at the end, and cracking tools try those patterns first. A password picked by a secure random generator has no pattern to exploit, so an attacker has to try every possibility.
This generator draws each character independently from the set you choose. With all four character types switched on there are 87 possible characters, so every character adds about 6.4 bits of entropy. The default 16 characters give roughly 103 bits, far beyond what anyone can brute-force.
Choosing the settings
- Length matters most. 16 characters is a good default for accounts. Use 20 or more for anything that protects other accounts, like your email.
- Turn off symbols only when a site rejects them. You lose less than you might think: 16 letters and digits still give about 95 bits.
- Avoid look-alikes when you will read the password aloud or type it from paper. It removes I, l, 1, O, 0, o and quote marks.
- Start with a letter for older systems that refuse passwords beginning with a digit or symbol.
After you generate
Copy the password straight into your password manager and the site’s sign-up form. Do not keep it in a notes app or an email. The page itself saves nothing: refresh it and the values are gone for good.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created on your device with the browser’s Web Crypto API (crypto.getRandomValues). Nothing is sent over the network and nothing is stored, which you can confirm in your browser’s developer tools.
How long should my password be?
At least 12 characters for low-value accounts and 16 or more for anything important. With a password manager there is no cost to going longer, so 20 to 32 characters is a fine habit.
Why does every password include each character type I selected?
Many sites require at least one uppercase letter, one number and one symbol. The generator retries until each selected type appears, so the password passes those checks the first time.