Password Generator

Why random matters more than clever

Humans are bad at generating randomness. Ask someone to make up a password and you'll get a pattern rooted in memory — a pet's name, a birth year, a keyboard walk like qwerty123 — because the brain reaches for the familiar. Attackers know this, which is why cracking tools ship with dictionaries of common substitutions (@ for a, 0 for o, ! at the end) that defeat "clever" passwords in seconds. A password generator sidesteps human bias entirely by pulling bytes from your browser's cryptographically secure random number generator (the same source used for TLS keys), so every character is statistically independent of the last.

The output isn't meant to be memorable — it's meant to be stored in a password manager. That trade-off (unmemorable but unbreakable) is the whole point: you only need to remember one master password, not dozens of hand-crafted ones.

How length and character sets affect strength

Password strength is measured in entropy — roughly, how many guesses an attacker needs on average. Each character you add multiplies the search space rather than adding to it: a 12-character password using lowercase, uppercase, digits and symbols (a 94-character alphabet) has about 78 bits of entropy, while adding just 4 more characters pushes it past 100 bits, which is effectively uncrackable with current hardware. This is why length beats complexity rules — a 20-character passphrase of random words can outlast a 10-character jumble of symbols.

• Lowercase + uppercase + digits + symbols: maximum entropy per character
• Excluding ambiguous characters (l, 1, I, O, 0) helps when a password must be typed or read aloud
• 16+ characters is a reasonable modern minimum for anything important

Where this actually gets used

The obvious case is a new account signup, but generated passwords also cover Wi-Fi router admin panels, database root credentials, API keys used as passwords, and shared service accounts on a team where reuse is a real security risk. Many sites still enforce oddly specific rules — "must contain a symbol but not a space," "maximum 20 characters" — so being able to toggle character sets on and off in seconds, rather than manually editing a password until it satisfies a form, saves real friction.

A note on reuse and rotation

The single biggest risk to any password, generated or not, is reuse across sites: if one service is breached and you used the same password elsewhere, attackers try it everywhere else automatically (a technique called credential stuffing). Generate a fresh, unique password for every account and let a password manager do the remembering — that habit alone blocks the majority of real-world account takeovers.