Password Generator

The instinct to build a short password out of exotic symbols is backwards. What resists a guessing attack is the number of possible passwords, and length raises that count far faster than character variety does. Each extra character multiplies the search space by the size of the alphabet; adding symbols only widens the alphabet once.

Concretely: a random 8-character password using the full 94-character printable set has about 6 x 10^15 combinations. A random 16-character password using only lowercase letters has about 4 x 10^22 combinations, roughly seven million times more, despite looking simpler. This is why current guidance from NIST dropped mandatory complexity rules and raised the recommended minimum length. Generate at least 16 characters for anything that matters and 20 or more for a password manager's master password or an email account, which is the key to everything else.

Human-chosen passwords cluster. People substitute 3 for e, append a year, and put the capital letter first and the digit last, and cracking tools model all of it. A password like Summer2026! satisfies almost every corporate complexity policy and falls in seconds to a rule-based attack, because the rule that produces it is one of a few hundred that attackers try first.

Randomly generated strings have no such pattern to exploit. The trade-off is that you cannot remember them, which is fine, because you should not be trying to. Store generated passwords in a password manager and memorise exactly two things: the manager's master password and your device unlock. If you genuinely need a password you can type from memory, use a passphrase of four or five unrelated random words instead; it is long, high-entropy, and typeable.

A strong password is only as safe as what you do with it in the next sixty seconds. Generation here happens in your browser using the crypto random number generator, so nothing is sent to a server, but the result still passes through your clipboard. Clear the clipboard after pasting, or let a password manager fill the field directly so the value never enters it.

A few habits do more for account security than any character-set tweak. Never reuse a password across sites, because a breach at one becomes a break-in everywhere else; credential-stuffing attacks run stolen pairs against hundreds of services automatically. Turn on two-factor authentication wherever it is offered, since it holds even when a password leaks. Stop rotating passwords on a schedule unless you suspect a compromise, because forced rotation pushes people toward predictable increments. And never email or message a password; send it through a manager's sharing feature or a one-time secret link.