Password Generator

What makes a password strong?

A strong password is long (12+ characters), uses multiple character types (uppercase, lowercase, numbers, symbols), and has no dictionary words or predictable patterns. Length matters most: a 16-character random password is exponentially harder to crack than an 8-character one. Avoid: names, dates, keyboard walks (qwerty), and simple substitutions (p@ssw0rd).

How long should a password be?

Minimum 12 characters for general accounts, 16+ for important accounts (email, banking, password manager master). A 12-character random password with all character types has ~74 bits of entropy — cracking it would take millions of years on modern hardware. Every extra character multiplies the combinations by the character set size.

Is it safe to generate passwords in this tool?

Yes. All passwords are generated in your browser using the Web Crypto API (crypto.getRandomValues()) — a cryptographically secure random number generator. No passwords are sent to any server, stored, or logged anywhere. You can turn off your internet and the tool still works — it's 100% client-side.

Should I use a password manager?

Yes — it's the most effective security upgrade you can make. A password manager lets you use unique, strong passwords for every site without remembering them. Use this tool to generate strong passwords, then store them in Bitwarden (open-source, free), 1Password, or Dashlane. Never reuse passwords.

What is password entropy and what does 'bits' mean?

Entropy measures how unpredictable a password is. Higher bits = harder to crack. With a pool of 72 characters and 16 characters length: 72^16 possibilities = ~98 bits entropy. At one billion guesses per second, cracking 98-bit password would take longer than the age of the universe. 60+ bits is considered strong for most purposes.

How often should I change my passwords?

Modern security guidance (NIST, NCSC) no longer recommends routine password rotation — it causes users to pick weaker, predictable patterns. Change a password when: you suspect a breach, the service reports a data leak, or you shared it with someone. Enable two-factor authentication (2FA) — it matters more than rotation.