Most account break-ins do not come from a clever attacker guessing a random string. They come from passwords that were reused, short, or easy to predict. A generator fixes the “easy to predict” part. Everything else depends on how you use what it gives you.
How the generator works
The Password Generator runs in your browser and draws its characters from crypto.getRandomValues, the browser’s cryptographically secure random source, rather than the weaker Math.random. Nothing is sent to a server. Choose a length of 8, 12, 16, 24, 32 or 64, tick the character sets you want (uppercase, lowercase, numbers, symbols), and optionally generate several at once.
What length buys you
Strength is measured in bits of entropy: the more bits, the more guesses an attacker needs. For a random password, bits = length × log2(pool size). With all four sets ticked, the pool is 87 characters:
| Length | Lowercase only (26) | Letters and digits (62) | All four sets (87) |
|---|---|---|---|
| 8 | 37.6 bits | 47.6 bits | 51.5 bits |
| 12 | 56.4 bits | 71.5 bits | 77.3 bits |
| 16 | 75.2 bits | 95.3 bits | 103.1 bits |
| 20 | 94.0 bits | 119.1 bits | 128.9 bits |
Each added character is worth more than switching on another character set. Going from 8 to 16 characters with the same set doubles the bits; adding symbols to a 16-character letters-and-digits password adds about 8. If a site rejects symbols, make the password longer instead.
What the standards say
The U.S. NIST password guidance (SP 800-63B) favours length over forced complexity: it asks sites to allow long passwords, bans arbitrary composition rules, requires checking new passwords against lists of known compromised ones, and says password managers and pasting must be allowed. For passwords used as the only login factor it sets a minimum of 15 characters.
Using generated passwords safely
- Generate a password at least as long as the site allows, up to 16 to 24 characters for ordinary accounts.
- Copy it straight into a password manager. A random 16-character string is not something you can or should memorise.
- Use a different one for every account. A single reused password turns one site’s breach into many.
- Turn on two-factor authentication for email, banking and anything that can reset other accounts.
What a generator cannot do
It cannot protect a password you paste into a phishing page, type on an infected computer, or keep in a plain note anyone can open. Treat the generator as the first step, with a manager and two-factor sign-in as the other two. For anything you only need as a placeholder, a lower setting is fine; for accounts that matter, go long.
Frequently asked questions
Is it safe to use an online password generator?
This one runs in your browser and sends nothing to a server, but you are still trusting the page you loaded. Many people prefer the generator built into a reputable password manager for the same reason: it saves the password at the moment it creates it.
How often should I change my passwords?
NIST guidance advises against forcing routine changes. Change a password when you suspect it was exposed or when a service reports a breach, and keep every password unique.
Source: NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management (section on password verifiers).