Strong Password Generator

How to use the Password Generator

1. Set the length first

   Length matters more than any other setting. Sixteen characters is a sensible floor for ordinary accounts; go to twenty or more for email, banking and anything holding client data.

2. Enable every character set you can

   Uppercase, lowercase, numbers and symbols together maximise the search space an attacker has to cover. Disable symbols only when a site refuses to accept them.

3. Watch the entropy meter

   It shows strength in bits. Under 60 is weak, 80 or above is strong, and above 100 is beyond any realistic brute-force attack for the foreseeable future.

4. Copy it straight into a password manager

   Do not try to remember it — that is the manager's job. Generate, paste into the manager, save. You should never see the password again.

5. Use a different one for every account

   Reuse is what turns one company's breach into your problem everywhere. A unique password per site contains the damage to that single site.

What this tool does

Length beats complexity

The old advice — at least eight characters with a number and a symbol — is out of date and actively misleading. It produces passwords like P@ssw0rd1, which satisfies every rule on the form and appears near the top of every cracking dictionary in existence.

What actually resists attack is entropy: the number of possible passwords an attacker would have to work through. Entropy grows far faster with length than with character variety.

Sixteen random characters is stronger than almost anything a person composes, including long passphrases, because human word choice is not random. Take the length over the cleverness.

Why the random source matters

Most quick password scripts on the web use JavaScript's Math.random(). It is fast, it looks random, and it is not cryptographically secure — the sequence is deterministic, and given enough output an attacker can predict what comes next.

This generator uses crypto.getRandomValues(), the browser's cryptographically secure random source, which draws from the operating system's entropy pool. The distinction is invisible in the output and decisive in the security.

It also matters where generation happens. Any password generator that runs on a server has, by definition, had your password pass through someone else's machine. Even with good intentions, that is a log file waiting to happen. Everything here runs client-side: the password is created in your browser's memory and never transmitted.

You need a password manager

There is no point generating a twenty-character random password if you then write it on a sticky note or reuse it across five sites. The generator and the manager are two halves of one system.

A password manager solves the actual problem: you have a hundred accounts, each needs a unique unguessable password, and no human can hold that. Instead you remember one strong master passphrase, and the manager holds the rest. Bitwarden, 1Password and KeePass are all sound choices; browser-built-in managers are a real improvement on reuse, though dedicated tools handle sharing and recovery better.

Two rules for the master password. Make it long — a passphrase of four or five unrelated words, which you can actually remember. And never reuse it anywhere else, ever.

Two-factor authentication matters more than password strength

Worth being blunt: for most people, the biggest security gain available is not a longer password. It is turning on two-factor authentication.

A strong password protects you against guessing. It does nothing if the site gets breached and your hash leaks, or if you are phished into typing it into a convincing fake login page. Two-factor authentication protects against both.

Prefer an authenticator app over SMS. SIM-swap fraud is a genuine and growing problem, and an attacker who ports your number receives your codes. App-based codes or a hardware key are not vulnerable to that.

Where passwords actually leak

People picture a hacker patiently guessing. In practice, credentials are compromised in three ways, and only one of them is brute force.

1. Database breaches. A site you signed up to in 2019 gets breached and its password table appears online. If you reused that password, every other account using it is now open. This is why uniqueness matters more than complexity.
2. Phishing. A convincing email leads to a convincing fake login page, and you type your password into it yourself. Password strength is irrelevant here. Two-factor authentication is what saves you.
3. Credential stuffing. Attackers take username and password pairs from old breaches and try them automatically across hundreds of other services. It works because reuse is so common.

Check whether your addresses appear in known breaches at Have I Been Pwned. If they do, change those passwords first — starting with your email account, because whoever controls your email can reset everything else.

Sensible lengths by account type

• Email: 20+ characters. This is the master key to every other account through password reset. Treat it as the most important password you own.
• Banking and payments: 20+ characters, with two-factor authentication mandatory.
• Business systems — hosting, CMS, CRM: 20+ characters, unique per system, never shared over WhatsApp or email.
• Ordinary accounts: 16 characters is ample.
• Throwaway signups: 16 characters, still unique. It costs nothing when a manager is doing the remembering.

What not to do

Do not send passwords over WhatsApp, email or SMS — those messages persist in backups, on other people's phones and in cloud archives long after the conversation ends. Use your password manager's secure sharing feature instead.

Do not force staff to rotate passwords every 90 days. Both NIST and the UK's NCSC now advise against scheduled expiry, because it pushes people towards predictable increments — Summer2025! becomes Autumn2025!. Change a password when there is a reason to: a breach, a departure, a suspicion. Not on a calendar.

Frequently asked questions