Passwords That Actually Keep You Safe

The rule you were taught is out of date

"At least one uppercase letter, one number, one symbol" was the standard advice for years, and it produced a predictable side effect: people satisfied the rule with the smallest possible change, turning password into Password1! — technically compliant, and one of the first guesses any password-cracking tool tries. The rule optimized for a checkbox, not for actual resistance to guessing.

Current guidance, including NIST's digital identity guidelines (SP 800-63B), has shifted the emphasis to length. A long password built from a wide range of random characters is dramatically harder to crack than a short one stuffed with mandatory symbols, because the number of possible combinations grows with every additional character — far faster than it grows from adding one more character type to a short string.

What this means for the settings you actually pick

Length matters more than composition, so when you're deciding what to generate, lead with length:

• Everyday accounts — the generator defaults to 20 characters with numbers and symbols on, which is a strong setting to simply leave alone. Treat 16 as the floor worth dropping to only if something forces it.
• High-value accounts — email, banking, your password manager's own master password — push to 20 or more. These are the accounts that, if compromised, give access to everything else, so they're worth the extra length.
• A site that rejects long passwords or symbols — some older systems still cap length or reject certain characters. Turn off symbols, keep the length as high as the site allows, and treat that site's own limitation as the constraint, not a reason to shorten everything else.

This tool generates its randomness with crypto.getRandomValues, the browser's cryptographically secure random number source — not Math.random(), which some password generators still use and which is predictable enough that it shouldn't be trusted for anything security-related. That distinction doesn't show up anywhere in the output, but it's the difference between a password that's actually unpredictable and one that only looks that way.

Why generate one instead of inventing one

People are reliably bad at being random. Leaked password databases show the same patterns over and over: a capital letter at the front, a number and an exclamation mark at the end, a substituted 3 for an e. Those substitutions feel clever and add almost nothing, because cracking tools have encoded exactly those habits for decades. A generator has no habits — that's the entire point of using one rather than thinking one up.

What this tool won't do, on purpose

It generates random characters, not a memorable passphrase of real words. That's a deliberate tradeoff, not a missing feature: a random character string is more resistant to guessing per character than a passphrase of the same length, but it's effectively impossible to memorize. The realistic modern answer to that isn't to make the password weaker so you can remember it — it's to not need to remember it at all.

The part that actually makes this work: a password manager

A long random password only helps if it's also unique to that one account, and nobody memorizes forty unique 20-character strings. A password manager generates and stores that, so the only password you need to actually remember is the one that unlocks the manager itself — which is exactly the account worth spending the most length on. Everything else can be as random and unmemorable as this tool makes it, because you're never typing it from memory.

Use a passphrase for the one password you must memorise

For that one master password — the only one you actually have to memorise — a passphrase is the better tool than a random string. Four or more unrelated words strung together (maple-rocket-velvet-tiger) gets you real length, which is what matters most, while staying possible to remember. That's the one place the "memorable" approach genuinely wins, and it's why this generator's output isn't the right shape for it.

Why a unique password per site matters

This matters more than it sounds like it should, because of how breaches actually play out. When one site is breached and its password database leaks, attackers immediately try those same email-and-password pairs against every other major site — a technique called credential stuffing. A reused password turns one breach you had no control over into a compromised account everywhere else you used it. A unique password per site means one leak stays contained to that one site.

Isn't putting every password in one place risky?

It's the fair objection, and the honest answer is that it trades many small risks for one well-defended one. Managers that use end-to-end encryption encrypt your vault so that the company operating it cannot read your passwords even if their own systems are breached — worth confirming for any manager you are considering, since it is a design choice rather than a given. Weigh that against the alternative you're actually choosing between: not a perfect memory, but reused passwords, a notes file, or a browser storing them with no master password at all.

Is a 12-character password still good enough?

It's meaningfully weaker than 16 or 20, though still far better than reusing a short password across multiple sites. If a specific site caps you at 12, that's a limitation of that site, not a reason to cap everything else you generate at 12 too — use the maximum length each site allows.

Do I need symbols if my password is already long?

Length contributes more to strength than symbols do, but symbols still add real value on top of length, and this tool makes including them free — there's no real cost to leaving that toggle on. Turn it off only for a site that specifically rejects symbol characters.

How often should I actually change my passwords?

Current guidance has also moved away from mandatory periodic rotation — changing a good, unique, unreused password on a schedule doesn't meaningfully improve security, and it mostly trains people toward weaker, more predictable passwords they can remember the pattern of. Change a password when you have a specific reason to: a breach notice for that site, or suspicion the account was compromised.

Last reviewed: September 2026