How to Generate Strong, Secure Passwords Online

Weak passwords are the number-one cause of account breaches. Despite years of warnings, the most common passwords in data leaks are still 123456, password, and qwerty. If you're still reusing passwords or choosing memorable ones, your accounts are at risk. A random password generator creates passwords that are genuinely impossible to guess — and the good ones do it entirely in your browser, so nothing is ever transmitted online.

What Makes a Password Strong?

Security researchers measure password strength using entropy — a mathematical measure of unpredictability. The more entropy a password has, the longer it would take an attacker to crack it by brute force.

Three factors determine entropy:

• Length — Every extra character multiplies the number of possible combinations exponentially. A 16-character password is billions of times harder to crack than an 8-character one.
• Character set size — Using uppercase letters, lowercase letters, numbers, and symbols gives an attacker far more combinations to try than a password that uses only lowercase letters.
• Randomness — A password must be truly random. Substitutions like p@ssw0rd are well-known to attackers and provide almost no extra security.

The current recommendation from security experts is a minimum of 16 characters using a mix of all character types, or a randomly generated passphrase of four or more unrelated words.

How to Use the Password Generator

1. Set your length — Use the slider to choose between 8 and 64 characters. Longer is always better; 20+ characters is ideal for important accounts.
2. Choose your character types — Toggle uppercase letters, lowercase letters, numbers, and symbols on or off based on what the site allows.
3. Exclude ambiguous characters — Toggle this to remove characters like 0, O, l, and 1 that look similar, making the password easier to read if you ever need to type it manually.
4. Click Generate — A new random password appears instantly.
5. Copy and save it — Copy the password and immediately save it in your password manager before navigating away.

Why You Need a Different Password for Every Account

When a website is breached, the attackers publish the stolen usernames and passwords in lists known as "combo lists." They then run automated tools that try those credentials against every major website — Gmail, Facebook, your bank, your work email. This is called credential stuffing.

If you use the same password everywhere, a breach at a small forum you signed up for years ago could compromise your most important accounts. A unique, randomly generated password for every account means that a breach at one site exposes nothing else.

Using a Password Manager

A random 20-character password is impossible to memorise — and that's fine. You should be using a password manager that:

• Stores all your passwords in an encrypted vault
• Autofills login forms so you never have to type them
• Generates new passwords for you when you sign up
• Syncs across your devices

Popular options include Bitwarden (free, open-source), 1Password, and the built-in password managers in Safari and Chrome. If you're not using one already, today is a good day to start.

Tips

• Change compromised passwords immediately — Check if your email has been in a breach at haveibeenpwned.com.
• Enable two-factor authentication everywhere you can — even a weak password is much harder to exploit with 2FA enabled.
• Don't email passwords to yourself — Use a password manager instead.
• Avoid security questions — Answers like your mother's maiden name or first pet are often guessable or findable on social media. Use a random string as the answer and store it in your password manager.

Frequently Asked Questions

Is the password generator safe to use? Yes. The generator uses your browser's built-in cryptographic random number generator (window.crypto.getRandomValues), which produces genuinely unpredictable output — the same secure source used to generate UUIDs. No passwords are sent to any server.

How long should my password be? For most accounts, 16 characters is the minimum. For your password manager's master password, email, and banking accounts, use 20+ characters.

What if a site doesn't allow symbols? Disable symbols in the generator settings. Compensate by increasing the length — a 24-character alphanumeric password is still extremely strong.

Should I use passphrases instead? Passphrases (four or more random words like maple-rigid-cloud-seven) are excellent — highly secure and easier to type. They work best where you occasionally need to type the password manually, like your computer login.