Password Generator

Password strength comes down to entropy — the number of possible combinations an attacker would have to try. Two factors drive it: length and character variety. Each additional character multiplies the search space, which is why length matters more than complexity tricks. An 8-character password using all four character types has around 6 quadrillion combinations, which modern cracking hardware can exhaust in hours. A 16-character password from the same character set has about 10³¹ combinations — utterly impractical to brute-force with any foreseeable technology. That is why security bodies such as NIST now recommend prioritizing length, with 12-16 characters as a sensible minimum for important accounts.

Equally important is randomness. Human-chosen passwords follow predictable patterns — dictionary words, keyboard walks like qwerty, birth years, and predictable substitutions like using 0 for o. Cracking tools try these patterns first, which is why a truly random 12-character password is stronger than a clever-looking 16-character phrase built from common words and dates.

Use a unique password for every account. Credential-stuffing attacks take passwords leaked from one breached site and try them everywhere else; a unique password confines the damage of any single breach. Use a password manager. Nobody can memorize dozens of random 16-character strings — a reputable password manager stores them encrypted and fills them in for you. Enable two-factor authentication on email, banking, and any account you would hate to lose; even a stolen password is useless without the second factor. Never share passwords over email or chat, and be suspicious of any site or person asking for one outside the normal login flow.

This generator uses the Web Crypto API — the same cryptographically secure randomness source used by security software — rather than ordinary pseudo-random functions, and generates everything on your device.