Weak passwords are the leading cause of account takeovers: birthdays, phone numbers and "123456" barely slow down credential-stuffing attacks. Generating genuinely random, strong passwords is the cheapest thing you can do to harden your accounts. This article covers what makes a password strong, how to use a generator properly, and the habits that keep your passwords safe.
What Makes a Password "Strong"?
Strength comes from the number of possible combinations — its entropy. Two factors dominate: length and character-set size.
- Length first: every extra character multiplies the combinations. 12+ characters is the current baseline.
- Character set: upper + lower + digits + symbols beat digits alone by orders of magnitude.
- Randomness: human-made passwords follow patterns (dates, keyboard paths) that dictionary attacks exploit; true randomness has no pattern.
- Uniqueness: a different password per site stops one leaked database from cascading into the rest of your accounts.
Generate a Strong Password Online
- Open the tool: go to the password generator.
- Set the length: 16–20 characters is a good default; lower it only if a site caps it.
- Pick character sets: upper, lower, digits and symbols are on by default; deselect symbols if a site disallows them.
- Exclude ambiguous characters: opt out of
0O1lIso the password is easy to type by hand. - Check the strength rating: the tool scores entropy and shows weak/medium/strong — aim for strong.
- Copy and store: save it in a password manager or your browser's built-in vault.
Security note: generate and store passwords on a device you trust, and never share passwords in plain text over chat.
Where Randomness Comes From
Our generator uses the browser's cryptographically secure random number generator (crypto.getRandomValues) rather than ordinary Math.random, so every character is drawn uniformly and unpredictably. Generation happens entirely locally — your password is never sent to any server, which removes the risk of interception that cloud-based generators carry.
Habits That Keep Passwords Safe
| Habit | Practice |
|---|---|
| Use a password manager | Store random passwords; remember only one master password |
| Enable 2FA | Even a leaked password can't log in without the second factor |
| Act on breach alerts | Change the affected password immediately |
| Never reuse | One unique password per account stops credential stuffing |
Frequently Asked Questions
How many characters should a password have?
At least 12 today; 16+ for high-value accounts like email and banking. Length beats complexity.
Are generated passwords recorded or uploaded?
No. Generation is fully local using cryptographically secure randomness — nothing is transmitted.
Should I change passwords regularly?
Not necessarily — with 2FA and no known breach, frequent changes add little. Do change immediately if you suspect exposure.
What if a site only allows 8 characters?
Generate at the maximum allowed length with all character classes, and add 2FA to that account.
References
- Web Crypto API (getRandomValues) — MDN Web Docs: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
- Password security guidance — OWASP Password Storage Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html