Password Generator

What Actually Makes a Password Strong

The single biggest lever on password strength is length, not the mix of weird symbols people usually fixate on. The reason is entropy, a way of measuring how many guesses an attacker would need. Entropy is counted in bits, and every extra character you add multiplies the number of possible passwords rather than merely adding to it. With a 94 character keyboard set, each new character makes the guessing job 94 times harder. A password is only as safe as the number of combinations someone would have to grind through, and length is what pushes that number into the astronomical range.

This is why a long, all lowercase passphrase can beat a short password stuffed with symbols. Adding symbols widens the alphabet, which helps, but adding characters lengthens the exponent, which helps far more. The table below assumes a fast offline attacker making 10 billion guesses per second against a full mixed character set, which is a realistic figure for a determined adversary with modern hardware.

The jump from 8 to 16 characters is not twice as strong, it is trillions of times stronger. That is the exponential effect of entropy in action, and it is why every recommendation here starts with make it longer.

Never Reuse a Password

A strong password protects one account. The moment you reuse it, a breach at any single site puts every account that shares it at risk. Attackers know this, so after a leak they run credential stuffing: they take the leaked email and password pairs and replay them automatically against banks, email providers, and shops, betting that people recycle logins. One weak link becomes a master key. This is why unique passwords matter as much as strong ones, and why no amount of complexity saves a password you have used in three places.

Password managers are the real fix

Nobody can memorize a hundred unique random strings, and you should not try. A password manager generates and stores a different long random password for every account, so you only remember one strong master password. Generate a fresh value here, paste it into the manager, and never see it again. That habit gives you both strength and uniqueness with almost no daily effort.

Passphrases as an alternative

When you do need something you can type from memory, a passphrase of four or five random unrelated words is a strong and human friendly option. Randomly chosen words produce plenty of entropy while staying far easier to recall than a jumble of symbols, which is why they are a good pick for your master password.

How This Generator Stays Safe

A random password is only trustworthy if the randomness behind it is unpredictable. This tool uses crypto.getRandomValues, the browser cryptographic random source, and never Math.random. Math.random is a fast pseudo random generator meant for things like animations and games, and its output can be predicted or reproduced, so it must never be used to create secrets. The cryptographic source is designed specifically so that seeing past output tells an attacker nothing about future output.

Everything happens on your device. The password is assembled in your browser and is never transmitted, logged, or stored on any server. You could disconnect from the internet after the page loads and it would keep working, which is exactly what you want from a tool that mints secrets.