Generated entirely on your device
These passwords are produced by crypto.getRandomValues(), your browser's cryptographic random number generator, which draws entropy from the operating system. Nothing is transmitted, logged, or stored — the page has no server component at all.
That said, the general advice holds: generating passwords in a password manager is better practice than any web page, because the manager also stores them safely. This tool is useful when you need something quickly or for a non-critical account.
What actually makes a password strong
Strength is measured in entropy — the number of guesses required on average to find it. The formula is:
entropy (bits) = length × log₂(character set size)
A 20-character password drawn from a 94-character set carries about 131 bits. Each additional bit doubles the search space, so the relationship is exponential rather than linear.
Crucially, length matters more than complexity. A 20-character lowercase password has around 94 bits of entropy; an 8-character password using every symbol on the keyboard has about 52. The longer, simpler one is roughly 1012 times harder to crack.
This is why the old advice about mandatory symbols and forced 90-day rotation has been dropped by most modern guidance, including NIST. Those rules produced predictable patterns — Password1!, Password2! — rather than strong passwords.
Passphrases
Several random words are both memorable and strong. Four words drawn from a 7,776-word list — the Diceware approach — carry about 51 bits of entropy. Six words carry about 77 bits, which is comfortably beyond brute-force reach.
The critical requirement is that the words are chosen randomly. A phrase you invented is not random: human word choice is heavily biased, and cracking tools model that bias. “correct horse battery staple” is strong as a concept and worthless as an actual password, since it appears in every wordlist.
Passphrases are best for the few passwords you must actually memorise — your device login and your password manager's master password. Everything else should be random and stored.
The habits that matter more than the password
Never reuse passwords. This is the single most important rule. Credential-stuffing attacks take username and password pairs from one breach and try them everywhere else. Reuse turns any single breach into a compromise of every account sharing that password.
Use a password manager. It is the only practical way to have a unique strong password for every account. The commonly raised objection — a single point of failure — is real but far outweighed by eliminating reuse.
Enable two-factor authentication wherever it is offered. An authenticator app or hardware key is considerably stronger than SMS, which is vulnerable to SIM-swap attacks. 2FA protects the account even if the password leaks.
Check for breaches. Services that let you check whether an address appears in known breaches are worth using periodically.
Why forced rotation fell out of favour
Regular mandatory password changes were standard advice for decades and have now been reversed by most authorities, including NIST's digital identity guidelines.
The evidence showed that forced rotation made security worse. Users responded predictably — incrementing a number, changing a symbol, writing passwords down — producing weaker and more guessable credentials than they had before.
Current guidance is to use long unique passwords, keep them, and change them only when there is reason to believe one has been exposed. That is a change worth knowing about, because many organisations still enforce the old policy.
Frequently asked questions
How long should a password be?
At least 16 characters for anything important, and longer where allowed. Length contributes more to strength than complexity - a 20-character lowercase password is far stronger than an 8-character one using every symbol.
Are these passwords generated safely?
They use crypto.getRandomValues, your browser's cryptographic random source, and nothing leaves your device. Generating them inside a password manager is still better practice, since the manager also stores them.
Should I change my passwords regularly?
Modern guidance, including NIST's, says no. Forced rotation led people to make predictable small changes, weakening security. Use long unique passwords and change them only if you suspect exposure.
Is a passphrase better than a random password?
For the few passwords you must memorise, yes - it is easier to remember at equivalent strength. The words must be chosen randomly, not by you, since human word choice is highly predictable.