What makes a strong password?

Length matters most

Each extra character multiplies the number of possible combinations exponentially. A 20-character password is billions of times stronger than a 12-character one.

Mix character types

Using uppercase, lowercase, numbers, and symbols together dramatically increases the keyspace an attacker must search through.

Never reuse passwords

Generate a unique password for every account and store them in a password manager. This tool uses crypto.getRandomValues() — cryptographically secure randomness.

How to Use the Password Generator

Set password length — minimum 12 characters for basic security, 16+ for sensitive accounts, 20+ for critical accounts (banking, email, admin access).
Select character types — include uppercase, lowercase, numbers, and symbols for maximum security. Some sites restrict symbols — uncheck if needed.
Generate the password — click Generate for a new random password. Each click produces a completely different result.
Check the strength meter — the tool shows password strength (weak/fair/strong/very strong) based on length and character variety.
Copy and save immediately — copy to your password manager before navigating away. This tool does not store passwords — there is no way to retrieve a generated password later.

🔐 Most important rule: Never reuse passwords. Use a unique password for every account. When one site is breached (and breaches happen constantly), credential stuffing attacks try that username/password combination on hundreds of other sites. Unique passwords limit each breach to one account.

Understanding Password Security

🔢 Password Entropy

Entropy measures password unpredictability in bits. A 12-character password using all character types (95 possibilities per position) has 12 × log2(95) = 78.8 bits of entropy — sufficient against modern attacks. Each additional character adds approximately 6.6 bits. 128+ bits is considered cryptographically secure for most purposes.

⚡ Cracking Speed Reality

Modern GPU clusters can attempt 100 billion+ passwords per second against offline hash databases. An 8-character all-lowercase password has 26^8 = 208 billion combinations — crackable in seconds. A 16-character mixed-case+numbers+symbols password: 95^16 = 4.4 × 10^31 combinations — effectively uncrackable in any reasonable timeframe.

🌈 Rainbow Tables

Pre-computed tables of hash values for common passwords. Sites that store passwords as unsalted hashes are vulnerable — an attacker looks up the hash and instantly finds the password. Proper implementations use bcrypt, Argon2, or PBKDF2 with per-user salts, making rainbow table attacks impossible.

🔁 Credential Stuffing

Attackers obtain leaked username/password lists from breaches (billions of credentials are publicly available) and try them against other services. If you reuse passwords, one breach compromises all accounts using that password. This is the most common account compromise method — more common than hacking.

📝 Passphrase Alternative

A passphrase of 4+ random words (correct-horse-battery-staple) provides high entropy (44+ bits per word from a large wordlist) while being memorisable. 'CorrectHorseBatteryStaple' has approximately 44 bits of entropy — similar to a random 7-character password but far more memorable. NIST recommends passphrases for passwords humans must remember.

🔑 Password Manager Value

A password manager (Bitwarden, 1Password, KeePass) stores unique 20+ character random passwords for every site, auto-fills login forms, alerts you to breached passwords, and requires only one strong master password to remember. The security improvement from using a password manager is larger than any other single security action.

Password Security Best Practices

Tier your password strength

Not all accounts need the same password strength. Tier 1 (critical — use unique 20+ char password + MFA): email account, banking, password manager master password, work admin accounts. Tier 2 (important — unique 16+ char password): social media, shopping sites with saved payment methods, healthcare. Tier 3 (low value — still unique but can be shorter): forums, news sites, services with no payment or sensitive data.

Multi-factor authentication

A strong password combined with MFA is exponentially more secure than even the strongest password alone. MFA requires a second factor — authenticator app code (TOTP), hardware key (YubiKey), or biometric — that an attacker cannot obtain even with your password. Enable MFA on all Tier 1 accounts without exception. Authenticator apps (Authy, Google Authenticator) are more secure than SMS-based MFA.

Checking for breached passwords

Have I Been Pwned (haveibeenpwned.com) allows checking if your email or specific passwords have appeared in known data breaches. The site maintains a database of over 12 billion breached passwords. Major password managers integrate this check automatically — flagging if any stored password appears in breach databases. Check your email on HIBP and immediately change passwords for any accounts using breached credentials.

🔐 Password security checklist: Unique password for every account ✓. 16+ characters for important accounts ✓. All character types where allowed ✓. MFA enabled on email and banking ✓. Passwords stored in password manager ✓. Breached password check done ✓. These six steps provide 99%+ protection against the most common account compromise methods.

Frequently Asked Questions

How secure are the generated passwords?

Passwords use crypto.getRandomValues() — the Web Cryptography API. This is cryptographically secure randomness, the same source used by professional password managers. Nothing is sent to a server.

What password length should I use?

For most accounts: 16–20 characters minimum. For high-value accounts (banking, email, crypto): 24–32 characters. Length has exponentially more impact than character variety.

What does 'Exclude ambiguous characters' mean?

Removes visually confusing characters: uppercase O and zero (0), lowercase l and uppercase I, and number 1. Useful when typing or reading the password manually.

Is it safe to use an online password generator?

Yes — because this tool runs entirely in your browser with zero network requests. Open browser DevTools → Network tab and you'll see no outgoing requests when generating.