Password Generator

What Makes a Password Strong?

A strong password has two properties: length and unpredictability. Length is the single most important factor — each additional character exponentially increases the number of combinations an attacker must try. A 16-character password is astronomically harder to crack than an 8-character one, even if both use the same character set. Unpredictability means the password contains no dictionary words, names, dates, or patterns that a brute-force or dictionary attack could exploit. The best passwords are random sequences of uppercase letters, lowercase letters, numbers, and symbols — which is exactly what this generator produces.

Password Security Best Practices

• Use a unique password per account — Reusing passwords means a breach at one site exposes every account that shares that password.
• Use a password manager — Tools like Bitwarden, 1Password, or KeePass store and autofill strong passwords so you never have to remember them.
• Enable two-factor authentication (2FA) — Even a strong password can be stolen. 2FA requires a second factor (a code, hardware key, or biometric) to log in.
• Never share passwords via email or chat — Use a secure password-sharing tool if you need to share credentials with a colleague.
• Change passwords after a breach — Monitor services like Have I Been Pwned to know if your credentials appear in data breaches.

How the Generator Creates Random Passwords

This generator uses the Web Crypto API's crypto.getRandomValues() function, which is a cryptographically secure pseudorandom number generator (CSPRNG) built into every modern browser. Unlike Math.random(), which is not cryptographically secure, crypto.getRandomValues() produces output that cannot be predicted from previous values. No passwords are transmitted to any server — everything is generated locally in your browser.

How to Create a Strong Password

1. Set the length to at least 16 characters — longer is always stronger.
2. Enable uppercase, lowercase, numbers, and symbols so every character position draws from a large set.
3. Click generate, then copy the result straight into your password manager rather than reusing it from memory.
4. Use a different generated password for every account, and turn on two-factor authentication where available.

Frequently Asked Questions

How long should my password be?

For most accounts, 16 characters is the recommended minimum. For high-value accounts (email, banking, password manager master password), aim for 20–24 characters. At 16 characters with mixed case, numbers, and symbols, the number of possible combinations exceeds 10²⁸ — far beyond what any current or near-future hardware can brute-force.

Is it safe to generate passwords in a browser?

Yes, provided the generator uses a cryptographically secure random source. This tool usescrypto.getRandomValues() and runs entirely offline in your browser — no password is ever sent to a server or logged anywhere. Avoid generators that use Math.random() or that make network requests.

Should I include symbols in my password?

Symbols increase the character set, which increases the number of possible combinations for each character position. However, some systems do not accept all symbol characters. If a site rejects your generated password, regenerate with symbols disabled or try a different symbol subset. A longer password without symbols is often more secure than a shorter one with them.

What is the difference between a password and a passphrase?

A passphrase is a sequence of random words (e.g., "correct-horse-battery-staple") rather than a string of random characters. Passphrases are easier to memorise and can be just as secure as random character passwords if they are long enough (4+ random words). They are a good choice for passwords you need to type manually, like a computer login or password manager master password.

Can a randomly generated password be cracked?

In practice, no — not a sufficiently long one. A 16-character password drawn from mixed case, digits, and symbols has more combinations than a modern GPU cluster could test in billions of years. Real accounts are compromised through reuse, phishing, and data breaches, not by brute-forcing a strong random password — which is why a unique password per site matters more than any single password's length.

How often should I change my password?

Current NIST guidance is not to rotate passwords on a fixed schedule, because it pushes people toward weaker, predictable variations. Instead, use a long unique password per account and only change it if a service is breached or you suspect it was exposed.