Password Generator
Strong random passwords generated with your browser's cryptographic randomness — never sent anywhere, not even to us.
What makes a password strong
Only two things: length and true randomness. Every added character multiplies the search space; every human "pattern" (words, dates, keyboard walks, s@bstitutions) collapses it. Modern cracking rigs test billions of guesses per second against stolen password databases — but a random 16-character mixed password has ~1031 combinations, putting it beyond any practical attack.
The rules that actually matter
- Unique per site. Reuse is the #1 cause of account takeovers: one breached site unlocks the rest ("credential stuffing"). A password manager makes uniqueness effortless.
- 16+ characters for anything important; 12 is the bare floor.
- Turn on two-factor authentication for email and banking — it saves you even when a password leaks.
- Your email account outranks everything — it can reset all other passwords. Give it your strongest protection.
Random string vs. passphrase
Both work when random: "correct horse battery staple"-style passphrases (4–5 truly random words) are easier to type on a TV or memorize for a master password; random strings are denser (shorter for the same strength) and belong in a password manager. Use passphrases for the few you must remember, generated strings for everything else.
What length actually buys you
Using all four character sets (95 possible characters per position), each added character multiplies the search space by 95:
| Length | Entropy | Resistance to offline cracking |
|---|---|---|
| 8 | ~52 bits | Crackable — avoid |
| 12 | ~79 bits | Minimum acceptable today |
| 16 | ~105 bits | Strong for anything |
| 20 | ~131 bits | Beyond any foreseeable attack |
| 32 | ~210 bits | Overkill, and free when a manager types it |
The jump from 8 to 16 characters isn't twice as strong — it's roughly 6,600,000,000,000,000 times as strong. Since a password manager does the typing, there's no practical reason to choose anything under 16 for accounts that matter.
Why human-made passwords fail
Attackers don't guess randomly. They run leaked password lists, dictionary words with predictable substitutions, and known patterns — because those cover most real passwords. P@ssw0rd123! looks complex and satisfies most "strong password" rules, but it's in every cracking dictionary and falls in seconds. Meanwhile a plain random string of the same length is genuinely unbreakable. Complexity rules measure the wrong thing; randomness and length are what matter.
The habits that matter more than the password
- Never reuse. One breached site otherwise unlocks every account sharing that password — this is how most account takeovers actually happen.
- Protect your email first. It can reset everything else, so it deserves your strongest password and two-factor authentication.
- Turn on two-factor authentication for email, banking and anything with payment details. An app-based code beats SMS, which is vulnerable to SIM-swap attacks.
- Use a password manager. It's the only realistic way to have a unique 16+ character password everywhere, and it also refuses to autofill on lookalike phishing domains.
- Treat security questions as passwords. Your mother's maiden name is often public. Store a random string as the answer instead.