—
—
Generated with crypto.getRandomValues() — the browser's cryptographic random source,
not Math.random(). Nothing is sent over the network and nothing is stored.
Length beats complexity
Every extra character multiplies the number of possible passwords. Every extra character type only widens the alphabet a little. That makes length the far stronger lever.
| Password | Length | Rough time to crack |
|---|---|---|
| P@ss1! | 6 | Instantly |
| P@ssw0rd123 | 11 | Hours — it is built from dictionary words |
| xK9#mQ2vLp | 10 | Weeks |
| xK9#mQ2vLp4nR8 | 14 | Centuries |
| correct-horse-battery-staple | 28 | Longer than that, and memorable |
A 16-character random password is beyond brute force with current hardware. This is why the "memorable words" option exists: four random words are both easier to remember and harder to crack than a short string of symbols.
What actually protects an account
- Never reuse a password. Breaches get combined into lists and replayed against other sites. One reused password turns one breach into several.
- Use a password manager. Bitwarden, 1Password and the manager built into your browser all remove the need to remember anything.
- Turn on two-factor authentication. It protects the account even if the password does leak.
- Prioritise the accounts that unlock others — email first, then banking, then everything else. Whoever controls your email can reset most of your other logins.
- Check for breaches. haveibeenpwned.com tells you whether an address has appeared in a known leak.
What to avoid
- Names, birthdays, phone numbers, your city or your pet.
- Keyboard runs — qwerty, 123456, asdfgh.
- Predictable substitutions —
P@ssw0rdis in every cracking dictionary. - Adding a number to an old password.
Summer2025→Summer2026is the first thing an attacker tries. - Storing passwords in a notes file, a spreadsheet, or a browser tab.
Frequently asked questions
How long should my password be?
At least 12 characters, and 16 or more for email and banking. Length matters more than adding symbols — every extra character multiplies the search space.
Are these passwords really random?
Yes. They come from crypto.getRandomValues(), the browser's cryptographically secure random generator, rather than Math.random() which is predictable.
Is it safe to generate a password on a website?
On this one, yes — generation happens entirely in your browser with no network request, so the password never leaves your device. You can confirm this by opening your browser's network tab and pressing Generate.
Are word-based passwords weaker?
No, provided the words are chosen randomly and you use four or more. "correct-horse-battery-staple" is longer and stronger than a short symbol string, and far easier to remember.
Should I change passwords regularly?
Current guidance from NIST says no — forced rotation pushes people toward weak, predictable variations. Change a password when there is a reason to: a breach, a shared device, or any suspicion.
What is entropy?
A measure of unpredictability in bits. Each bit doubles the number of guesses required. Under 40 bits is weak, 60 is reasonable, and 80 or more is strong.