01Why a generator rather than your imagination?
Humans are terrible randomness generators: we pick words, dates, keyboard patterns — exactly what cracking tools try first. A truly random password drawn from a large character set can only be attacked by brute force, and its resistance is measured in bits of entropy: every bit doubles the attack time.
This generator uses crypto.getRandomValues, your browser's cryptographic generator — not predictable pseudo-randomness. Everything happens locally: the page makes no request, the password appears in no log, anywhere. You can verify it: cut your connection, the generator still works. Then check it hasn't already leaked with our leak test.
02Understanding the settings
- Length
- The dominant factor: going from 12 to 20 characters adds more security than any symbol. Aim for 16 minimum, 20+ for a password manager or a critical account.
- Entropy
- log2(set size) × length. 60 bits resist an amateur attacker, 80 bits a serious one, 100+ bits everyone for decades.
- Symbols
- They widen the character set (hence entropy per character), but some sites reject them: on error, lengthen the password instead.
- Ambiguous
- l, 1, I, O and 0 look alike in some fonts. Exclude them only if you must retype the password by hand — otherwise keep them, every character counts.
- Uniqueness
- One password per service, no exception. Reuse turns any site's leak into a master key — it is the number one hacking vector.
03The right habit: a password manager
The best password is one you don't know: randomly generated, unique per service, stored in a password manager (Bitwarden, KeePass, 1Password, or your browser's). You only remember a single master passphrase — long, memorable, never reused.
Add two-factor authentication (2FA) wherever it exists: even a stolen password becomes useless on its own. And when a service announces a breach, change the affected password immediately — our leak checker tells you whether it is already circulating.
04Frequently asked questions
Can this generator see or store my passwords?
No. Generation happens entirely in your browser using crypto.getRandomValues: the page makes no network request while generating, and the password is never transmitted nor stored. You can verify it by cutting your Internet connection: the generator keeps working normally.
What length should I choose?
16 characters minimum for an ordinary account, 20 or more for a critical one (primary email, bank, password manager). Length outweighs complexity: “correcthorse!” cracks faster than a 20-character random string, even without symbols. If a site caps the length, use the maximum allowed.
Is a strong password enough to protect me?
No: it protects against brute force and guessing, not against phishing (you type it on a fake site), database breaches (the site gets hacked), or a keylogger. Hence the three companions: a unique password per service, two-factor authentication, and periodic leak checks.
Is a passphrase better than a random password?
At equal entropy, they are equivalent — four to six words drawn at random from a dictionary (diceware) give 50 to 80 bits while staying memorable. Passphrases are ideal for what you must remember (your manager's master phrase, computer session); compact random strings are ideal for everything else, since the manager remembers them for you.
How often should I change my passwords?
Forced periodic rotation is an abandoned practice (NIST has advised against it since 2017): it encourages weak, incremented passwords. Change a password when there is a reason: an announced breach, a compromised device, a shared or reused password. Otherwise a strong unique password can live a long time.