Password
Length and character-class controlled passphrases
A strong password is one an attacker cannot guess faster than brute force allows, and brute force is governed by entropy — the number of equally likely possibilities. Entropy comes from length and from the size of the character set, and length is by far the more powerful of the two. Adding one character to a random password multiplies the search space; swapping an o for a zero does almost nothing.
That is the reason substitution tricks fail. Attackers do not guess character by character; they run dictionaries with every common substitution already applied. A random string of sufficient length, or a passphrase of several random words, defeats that approach because there is no pattern to exploit. Everything generated here comes from the browser’s cryptographic random source and is never transmitted.
How to use it
- Set the length firstLength matters more than any other setting. Sixteen characters is a sensible floor for an account that matters; twenty or more for anything protecting other credentials.
- Choose the character classesLower case, upper case, digits and symbols each widen the alphabet. Turning off symbols costs you some entropy, which you can win back by adding a couple of characters.
- Exclude look-alikes if you will type itRemoving characters such as l, I, 1, O and 0 makes a password readable off a screen and dictatable over a call, at a small cost in entropy.
- Copy it straight into your managerGenerate, copy, store. The value exists only in this tab and disappears when you close it — there is nothing to delete afterwards.
Frequently asked questions
How long should a password actually be?
For an account behind rate limiting and multi-factor authentication, sixteen random characters is comfortably enough. For something whose hash might be stolen and cracked offline — a password manager’s master password, a disk encryption key — go to twenty or more, or use a passphrase of five or six random words.
Are random characters better than a passphrase?
They are equivalent when the entropy matches. Six words drawn randomly from a list of 7,776 gives about 77 bits, roughly the same as a twelve-character random string from a full alphabet. The passphrase is far easier to remember and type, which is why it is the better choice for the handful of passwords you cannot store in a manager.
Do character substitutions like @ for a help?
Barely. Cracking tools apply every common substitution automatically, so P@ssw0rd! falls in essentially the same time as password. The rule that matters is that the password must be random — chosen by a generator, not by a person editing a word they already know.
Is it safe to generate a password in a web page?
It depends entirely on whether the page sends it anywhere. This one does not: generation uses crypto.getRandomValues in your own browser, no network request is made, and no value is stored. You can verify that by opening the network tab, or by disconnecting and watching the tool keep working.
Should I change my passwords regularly?
Not on a schedule. Both NIST and the UK NCSC now advise against forced rotation, because it pushes people toward predictable variations of an old password. Change a password when there is a reason to — a breach, a shared device, a suspicion — and otherwise leave a strong unique password alone.